How to store pictures in files on server to preserve privacy for some of those in WWW

Question

I am planing to bulid www portal in PHP, where many pictures will be stored. I decide to store pictures in directories at the server(not DB) for performence reason. Some pictures will be accessible for all users from internet, and some (if user set them private) not according to session id. What is the best solution of this problem? Perforance is important. Shoud I use some mod_rewrite or move private files to other directory than public?

John

Answer 1

There are two options:

1. Store the pictures in some publicly accessible folder of your site root, name the files such that the filename cannot be guessed (randomly generated and non-sequential), and make sure directory indexing is turned off. Only serve links to images that a user is authorized to see. Provided they don't share the links to their private photos, it will be very hard for people to accidentally (or intentionally) stumble across private photos.

2. Store the pictures outside of your site root, and serve them via a script which authenticates against the session. There are examples of how to read an image into memory and output it to the browser on the imagejpeg page of PHP.net

Answer 2

1. Do not allow users to hot-link to those images. Ignoring this means you'll be allowing freeloaders to steal network resources from other legitimate users.
2. Make sure those images are not in a Web-accessible path.
3. Find a way to throttle traffic. You don't want one user hogging bandwidth that should have been allocated to other users.

Answer 3

Store the private files outside of your wwwroot, only accessible via a php script, that checks access rights and forwards to a 403 page or servers the image, via readfile() for example.