如何防止访问PHP中的某些文件？

Question

I have a multi tenant PHP webapp which generates PDFs to be downloaded by the users. The PDFs are easily accessible via URL so users can preview or download them.

This is the schema of the URL

http://<mywebappaddress>.com/downloads/pdf_<userid>_<date>.pdf

The webapp lets the users access only their PDFs, however users could have a look at the URL, change the userid (guessing another user id maybe) and donwload PDFs from other users.

What's the best approach in PHP to prevent that?

Answer 1

There are many ways to prevent this

1. Encrypt pdf file name and store in database with user_id, and provide the name only to allowed user.

2. You could store all pdf files other than your serve like Amazon Simple Storage Service (Amazon S3)

First option is free