Apache/nginx fine grained (per file) permissions?

Question

Is it possible to set fine-grained permissions using either Apache or nginx? Given a large number of files and a large number of users, what's a good way to specify that each authenticated user only has access his/her own files?

user_a can access file_a_1, file_a_2
user_b can access file_b_1
user_c can access file_c_1, file_c2, file_c3, file_a_2

These are static, read-only files (for the most part). Imagine file-system like access control but with http. No web-dav; this is part of a web app; the images will display as part of the user's page in a browser. I want to make sure nobody else can see the image even if they can find the url for it.

Answer 1

Not entirely sure what you're looking to do. Do these users need write permissions, or are the files read-only? Are these static files?

Answer 2

Ugh. Short of writing your own authentication handler, I doubt there is an easy way of accomplishing this, at least with Apache.

If lighttpd were an option, I would probably implement the security check in a PHP script and if everything checks out, add a X-LIGHTTPD-send-file header to the response. This means that lighty will do all the file transfer without it going through PHP.

(A quick googling revealed that apache should support something like this with X-sendfile, but I was unable to get anything about this from the Apache documentation.)

edit: Apparently you can do a similar thing with Apache and mod proxy scgi.

Answer 3

I realize I'm necroposting here, but just for future googlers,

Here's the analogous nginx option for andri's solution:

http://blog.kovyrin.net/2006/11/01/nginx-x-accel-redirect-php-rails/

http://wiki.nginx.org/NginxXSendfile

...and the same thing for Apache, apparently:

http://tn123.ath.cx/mod_xsendfile/