PHP & .htaccess working together

Question

Any help on this would be greatly appreciated:

I have a website running with php on IIS6 IIS7. I am protecting all the .php files by starting a session. The .php pages can only be accessed if the session is started by logging in through the login.php page

All my .php files are in the following directory (using as example):

home/dir

Is it possible to use php and .htaccess to protect all files in the following directory:

home/dir/files

The files in this directory are word files, pdf's and other files types.

Once the user has logged in through login.php I don't want them to have to retype their username and password when trying to access home/dir/files

I hope that I made sense. Thank you.

Answer 1

In general, a good way to do this is to have the static files outside your website directory structure but still somewhere that the web server has permissions to access them. Then, since you're using PHP anyway, when a user requests a document, they would really be requesting a PHP page that checks the user's permissions then, if the user has adequate permissions, serves the file.

Answer 2

.htaccess are generally associated with Apache, not IIS, but see Is there a file-based equivalent to .htaccess in IIS6?

That said, perhaps you could put your files directory out of harms way and put it somewhere outside the document root. Then you can control download of each file through a PHP script which checks the authentication details.