Authentication / Denying access to files in directory with php

Question

I have a directory of files that logged-in users can upload to and access. Some of the files are public, and others are private - for internal access only. The filenames and access settings are saved in a database.

Can anybody give me some resources or show me an example of how i can use session data (and .htaccess?) to allow access of private files only to authorized users?

I'm thinking it might be easier to keep public documents in a seperate, unprotected directory, though i'd kind of like to keep everything together.

I'm not concerned about top-level security or encryption, as the files aren't terribly sensitive, but i want to keep them from being indexed on search engines, etc.

thanks!

Answer 1

I suppose I wouldn't use a .htaccess (or any kind of HTTP-authentication) for that : .htaccess / .htpasswd are great when you want to allow/deny access to a whole directory, and not to specific files.

Instead, I would :

• Deny any access to the files -- i.e. use a .htaccess file, containing Deny from All
  • That way, no-one has access to the file
  • Which means everyone will have to use another way to get to the files, than a direct URL.
• Develop a PHP script that would :
  • receive a file identifier (a file name, for instance ; or some identifier that can correspond to the file)
  • authenticate the users (with some login/password fields), against the data stored in the database
  • if the user is valid, and has access to the file (This is if different users don't have access to the same set of files), read the content of the file from your PHP script, and send it the the user.

The advantage is that your PHP script has access to the DB -- which means it can allow users to log-in, log-out, it can use sessions, ...

About the "send the file from PHP", here are a couple of questions that might bring some light :

• Sending correct file size with PHP download script
• Resumable downloads when using PHP to send the file?
• forcing a file download with php

Answer 2

I'd create a custom index script in PHP -- something that would show the files dynamically. Use that to keep only the right files being listed -- afterwards, to further protect the files, fetch file contents dynamically -- Pascal MARTIN's links show you how to use PHP to control the file streaming, you can use that to block access from hidden files to users that aren't supposed to get to them.