禁止在直接http上访问文件

Question

My question seems to be similar to others here in SO, I have try a few but it doesn't seem to work in my case...
I have develop a site in which you have to fill up a form and then it returns a PDF file that you can download or print, this file is saved so you can retrieve it later

public_html
      |_index.php
      |_<files>
      |    |_file_001.pdf
      |    |_file_002.pdf
      |_<asstes> ....etc

that is how my files and folders look on the server, anyone can easily guess other files, .com/folder/file_00X.pdf , where X can be change for any other number and get access to the file... the user after finish with the form the script returns a url .com/file/file_001.pdf so he/she can click on it to download...
a year ago I did something similar an script to generate PDF's but in that case the user needed the email and a code that was sent via email in order to generate the PDF and the PDF's are generated on demand not saved like in this case...
Is there a way to protect this files as they are right now?
or, do I have to make it a little bit more hard to guess?
something like.
.com/files/HASH(MD5)(MICROTIME)/file_(MICROTIME)_001.pdf
and save the file and folder name in the DB for easy access via admin panel, the user will have to get the full URL via email...

Any ideas would be greatly appreciated.

Answer 1

For full security i would move the PDFs out of the public folder and have ascript in charge of delivering the content. If the form is filled correctly, you can generate a temporary hash and store that hash and the pdf path in the database. That way the user will have access to the file as a link through the retriever script, but you will control for how long he will have that link available.

Imagine the temporary link being http://yourdomain/get_pdf/THIS_IS_THE_HASH

Answer 2

• Move the PDF's to some non-public folder (that your web server has access to but the public does not). Or you can use .htaccess to restrict access to the pdf's in their current location.

• Write a php script that returns the correct pdf based on some passed in http variable.

You can secure/restrict this any way that you want to.
For example, one answer suggested using a temporary hash.

Other options for restricting access:

• Store in the user's session that they submit the form and have a download pending, that way no one could direct link.
• Check the referrer header. If it is a direct request then do not serve the file.

Here is a code example using the last option:

$hash_or_other_identifier = $_REQUEST["SomeVariable"];

if (!$_SERVER["HTTP_REFERER"])
{
    //dont serve the file
} else {
    //lookup the file path using the $hash_or_other_identifier
    $pdfFile = somelogic($hash_or_other_identifier);

    //serve the correct pdf
    die(file_get_contents($pdfFile));
}

I don't even think that keeping the file name secret is a very big deal if all you are worried about is people typing it into the URL bar because you can simply check if it is a direct link or not. If you are also worried about bots or clever people who will create a link that points to your file so it looks like a referrer, then you will need to add stricter checks. For example, you can verify that the referrer is your own site. Of course headers can be spoofed so it all just depends how bulletproof it needs to be.

The url would be something like: http://yourdomain/pdf?SomeVariable=12345

However, you don't have to use an http variable. You can also use a url fragment with the same result, eg: http://yourdomain/pdf/12345

Answer 3

General guidelines:

• File is not in the directory that's accessible via HTTP
• Use a database or any other storage to link up file location with an identifier (an auto incremented number, guid, hash, whatever you deem fit). The location of the file could be in the server's file system or on a shared network location etc.
• Instead of hashes, it's also practical to encrypt the ID generated by the database, base64 encode it and provide it back - that makes it nearly impossible to guess the valid string that one needs to send back in order to refer to a file
• Use a PHP script that delivers the file if user authentication passes (in case you need authenticated users to be able to retrieve the file)