拒绝直接访问文件夹或文件，但允许index.php访问它

Question

I want to block direct access to the music folder on my website which contains my music.(I want the music to be played, but not downloaded)

But I also want to be able to play the music on the browser, I blocked access using the .htaccess file, but because of this, I cannot play the songs on the browser.

My .htacces file looks like this. and it is inside the music folder.

Order Deny,Allow
Deny from All
<FilesMatch "^$|(index)\.php$">
Allow from All
</FilesMatch>

Is there a way to do this, to play the song while direct access to the folder is blocked.

Answer 1

If the browser can access the data, by definition, it is downloadable. However I've had some success in situations like yours with the following approach:

Create a music.php file that does two things: 1) Checks the request for 'timeliness', and 2) Uses file_get_contents() to serve the content (using the correct Content-Type) without revealing the path to your music directory.

The request could look like http://blah.com/music/50/1521342509/j25ia920oj12501 .

• /music/ is not a directory, but a mod_rewrite condition/rule (in your .htaccess file), sending the request to music.php
• /50/ is the actual song name
• 1521342509 is the unix timestamp of the music request ... any requests more than a few seconds after this timestamp is likely a user attempt.
• j25ia920oj12501 is a hash of that same time timestamp (sha256, truncated after 16 characters is plenty), to ensure the timestamp is authentic.

This is far from foolproof, but is entirely effective at preventing all but the most dedicated/clever from downloading your stuff.