Question

do you know if it’s possible to make a file only available for download by clicking a link in code, and restrict access by trying to access the file from copy/pasting the URL in your address bar?

Example:

I generate invoices as PDF, and I want to make them available only for logged in customers and only the invoices that are generated for this specific customer. Customer A is not allowed to see the invoices from Customer B and vice versa.

Now I save these invoices here:
http://www.mydomain.com/invoices/

and an invoice for Customer A is something like:
http://www.mydomain.com/invoice/20130202_120045.pdf

now I want to make it possible that a customer can only see this PDF when I add a link like this in HTML:

<a href="http://www.mydomain.com/invoice/20130202_120045.pdf">See invoice</a>

but the PDF should NOT be accessible by typing in directly http://www.mydomain.com/invoice/20130202_120045.pdf in the address bar.

is this in some way possible ?

Answer 1

There are multiple approaches, but I’d say this is the easiest one:

• Store the actual PDF in a directory only accessible by PHP (outside your web root or blocked by .htaccess for example).
• Verify access in the PHP script.
• Let the download happen through a PHP script using the header Content-disposition to set the filename and using readfile() to output the file contents.