只有在登录时才允许访问文件（htaccess？）

Question

We have a set of files (images/documents) located on one subdomain (A), we then have another subdomain (B) that houses a CRM - both subdomains are hosted on the same server/IP and are subdomains of the same primary domain.

What we're attempting to achieve > Only users logged into B can access files within A.

We've tried a few solutions with htaccess within A eg only allow access to A's files if they have the correct IP. We also tried writing htaccess to only allow access to A's files if the user has been referred from B's subdomain - however neither of the attempts have worked....it's notable that we're not thoroughly experienced with htaccess!

We're assuming it's an htaccess job, not sure if we can achieve the result by using PHP instead (preferable)?

Any help greatly appreciated.

Answer 1

Here's an example, but needs more improvements:

On your CRM while starting the session, you need to make it available on all subdomains:

<?php

// Make session works on all subdomains
session_set_cookie_params(0, '/', '.example.com');
session_start();

Then create an htaccess at the root of (A), with the following contents:

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^(.*)$ /download.php?path=$1 [L]

This htaccess will make any request to any file on (A) gets processed by download.php .

And then create download.php , with the following contents:

<?php

if(! isset($_SESSION['your_session_id_here'])) {
    http_response_code(401);
    exit('Not allowed!');
}


if(! isset($_REQUEST['path'])) {
    http_response_code(400);
    exit('Invalid request!');
}

define('DOCUMENTS_ROOT', '/path/to/the/documents/');
define('AUTHORIZED_FILE_EXTENSIONS', ['png', 'jpeg', 'jpg', 'pdf', 'doc', 'zip']);

$path = DOCUMENTS_ROOT . $_REQUEST['path'];

$file_ext = pathinfo($path, PATHINFO_EXTENSION);
$file_ext = strtolower($file_ext);
if(! in_array($file_ext, AUTHORIZED_FILE_EXTENSIONS)) {
    http_response_code(401);
    exit('Not allowed!');
}


// We already did this on Htaccess
//if(! file_exists($path)) {
//    http_response_code(404);
//    exit('Not found!');
//}

header("Content-Description: File Transfer");
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=" . basename($path));
readfile($path);