Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.0k views
in Technique[技术] by (71.8m points)

apache - Best strategy to protect downloadable files -php/mysql Apache2 server

I'll trying to figure out how to protect directory from unauthorized or not autentificated user to download files. Thank's in advance.

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

Can't find a good duplicate, but a little search will bring up results like this PHP protect a folder

There is a simple way to restrict folder access based on PHP session authorization using php. It requires creating stub files for valid authorized sesssions (and automating their deletion). In PHP you do:

if ($user_has_permission_to_download)
{
   touch("tmp/access-" . session_id()); 
}

Then a simple rewriterule+rewritecond can then serve for authorization:

RewriteCond %{HTTP_COOKIE}        PHPSESSID=(w+)
RewriteCond ../tmp/access-%1      -f 
RewriteRule ^(.+)$  $1  [L]

RewriteRule .+  /deny   [L]

The first block permits access when the according cookie value is found and an authorization stub file exists. The second rule blocks access for anyone else.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...