preventing outside linking to a page

Question

I have a download script that processes my downloads:

download.php?file=file_refrence_here

How can I prevent someone from putting a link on their site such as:

http://www.mysite.com/download.php?the_file_refrence

Apparently $_SERVER[HTTP_REFER] is not secure.

Although I am just worried about general linking not people smart enough to change their header strings.

Answer 1

One way would be to include a time-limited hash which is validated before you allow the download. A distributed link then only has a small window of time in which it can be used.

For example

$file="foo.mp3";
$salt="youpeskykids";
$expiry=time()+3600;
$hash=md5($salt.$file.$expiry);

$url="download.php?file=$file&e=$expiry&h=$hash";

Now, when you process such a request, you can recalculate the hash and check that the presented hash is equal: this ensures that whoever made the URL knows the salt, which one hopes is just your site. If the hash is valid, then you can trust the expiry time, and if it hasn't expired, allow the download.

You could include other things in the hash too if you like, like IP address and user-agent, if you wanted to have more confidence that the user-agent which requested the download link is the one which actually does the download.

Answer 2

You cannot prevent someone from linking to your page as you cannot prevent someone to write the word sunflower on a sheet of paper.

But if you want to prevent that following such a link will result in downloading that resource, you would need to authenticate the request in some way. This could be done by generating random, temporary valid authentication tokens that only your page can create.

Answer 3

Another way would be to, when the download link is generated, encrypt a data packet that contains the user's IP number and pass this in the URL. The download script decrypts the packet and denies access if the IP number doesn't match the current remote address. That way, there's no time limit (not that one of those couldn't also be included if you liked), but the file can't be downloaded from any IP number other than the one that viewed the initial page.