PHP: Redirect downloads request with nginx or apache with keeping session

Question

I have a php web application running on several servers with a balancer.

One the functions of this web application is that logged users can download several files, but downloading several (and big) files from the web servers (with zipping) creates a lot of i/o and cpu usage, making web server hangs for the other users.

So my solution is to have a dedicated download server running the same web application (same code) and just serving download requests.

The question is: How can I detect automatically if the browser is sending a download request, and redirect it to the download server keeping php session (because only login users can download files?

Another problem I am dealing with is: most of download involves a zip process, with php this is very cpu consuming. Since I do not care about zip compression ratio, is there a way to serve (with any nginx header) a zip download on the fly without making a real compression? Example:

// Download several files via mod_zip
$spec = array();
foreach ($downloads as $download) {
    $fileSize = filesize($download['file']);
    $spec[] = sprintf("%d %s %s\n", $fileSize, $download['file'], $download['name']);
}
header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="files-' . date ("YmdHs") . '.zip"');
header('X-Archive-Files: zip');
die(implode($spec));

Details:

• Web server is running with nginx as proxy server and apache
• PHP session are stored in a database
• Download (zipped) files cat be larger than 1GB

Answer 1

This is an interesting question. I would personally do it a different way than you're suggesting.

Allow connections to the database on your main server from your download server, then add a new table with fields like "id" "files" and "auth".

When a user requests a download, redirect them to a php page on your main server, which will write a row to the table describing the file to be downloaded and an auth code for it, then redirect the user to a page on your download server, passing the ID and auth fields as GET variables.

The download server can then find the files that are needed, zip them and then send them to the user. It can then delete the row from the table afterwards (or even before the download begins), so that no one else can use that id and auth code again