php to serve PDF

kante

I want to set up my php app that already authenticates internet users to
let them download PDF files, but only after authentication.

The straight forward solution is to present the PDF download path only if they are authenticated, but what if someone distribute the absolute url?

I know there's a way to set up a PHP script to perform the download for you....only if the request is valid and recognized...
but I also read that is dangerous to have such a script on your webserver... cause someone could use it to download some other file from my website...(config files for example)

DO you have any safe solution for this? Example?

Thanks

bradgrafelman

kante wrote:
The straight forward solution is to present the PDF download path only if they are authenticated, but what if someone distribute the absolute url?

Then all of your security measures would be null and void, which is why you shouldn't provide a direct path to the files (nor should they be accessible by any direct URL) but instead use a PHP script to send the file only after verifying their credentials.

kante wrote:
I know there's a way to set up a PHP script to perform the download for you....only if the request is valid and recognized...
but I also read that is dangerous to have such a script on your webserver

It's dangerous if you don't know how such a script can be compromised and how to prevent it, sure. Then again, the same could be said about writing PHP code that interacts with a SQL database without having first studied up on SQL injections and data sanitization.

kante wrote:
DO you have any safe solution for this? Example?

It depends on how you decide to store the PDF files. If you index them in a database, for example, you could simply pass an integer ID of the pdf document (e.g. download.php?id=1234). Your download script could then query the database for the file path and then output the necessary headers & content.

If you instead didn't want to involve a database, you could simply pass the file name (e.g. download.php?file=My%20Cookbook.pdf). This one's where the common security risks come in, since you don't know if they're giving you the filename of a PDF document in a certain directory or instead a path like "../../config/mysql.inc.php". One way to make sure they're only giving you a filename, however, is to use something like [man]basename/man on the incoming data.

kante

thanks for the answer...

i guess i'll chose the DB query by id.

then serve the pdf sending the right headers...

as php manual says

<?php
// We'll be outputting a PDF
header('Content-type: application/pdf');

// It will be called downloaded.pdf
header('Content-Disposition: attachment; filename="downloaded.pdf"');

// The PDF source is in original.pdf
readfile('original.pdf');
?>

about this... i guess original.pdf better stays out of webserver public path, rite?

by this the end user should not be able to know the real location, and so refer to a absolute link to download directly form the webserver, bypassing authentication...

what about securing more the so downloaded pdf? is there a way to do it?
maybe password protecting it ...and generating a password on the fly before the download associated to theuser?
(i'm thinking to someone who obtain the pdf on his machine the redistribute it , but if i apssword protect it with his credential he will think twice b4 redistributing his pdf)

bradgrafelman

kante wrote:
i guess original.pdf better stays out of webserver public path, rite?

That would be recommended, yes, so that you can't possibly access the file directly via a direct URL. Alternatively, if that's not possible, you could add a .htaccess file to the directory that looks like:

Order allow,deny
Deny from all

kante wrote:
by this the end user should not be able to know the real location, and so refer to a absolute link to download directly form the webserver, bypassing authentication...

By placing the file itself outside of the root of your website, you don't really have to worry whether or not they know the absolute path to the the PDF file, since you can't access that path (presumably) via the webserver.

kante wrote:
what about securing more the so downloaded pdf?

That would be something you'd have to look into on your own - I haven't delved into the world of PDF manipulation.

I did see, however, that PDFlib claims to offer "AES-256 encryption, and Unicode passwords."