Question

Hello web development gurus

What is the best practice for storing and serving images securely without hurting performance?

Is it possible to store user images in a folder that’s not web accessible (possibly higher up and before /www?) and serve on demand after the user has logged in to the page? There is a username and password access mechanism already in place.

The users do not want these images to be publicly accessible.

I am running nginx with php on Ubuntu. Database is mysql.

Thank you!

Answer 1

You could use a php file to serve those images and do some checks before serving them. I would try something like this:

<?php
if ( /* YOUR CHECK HERE */ ) {
    header('Content-Type: image/jpeg'); // Or whatever your content type might be
    readfile('/path/to/file');
}

You could the use RewriteRule’s to make those calls to your php file look like real images:

rewrite /img/users/pictures/(.*) /your_php_file.php?path=$1 break;

Or something like that.

This may be secure but not very efficient because your server has to access two file. The php file and the image file