Question

I am often developing web applications that handle different media files (mp3, image files, pdf, etc..)

Some of these files are private to the site visitors, some are readable for all.

So far, I’ve always structured it like this:

/var/www/myapp/uploads/private/other_files_and_folders
/var/www/myapp/uploads/public/other_files_and_folders

Then I would protect the private/ folder with a server configuration (only identified users can access the folder), and public/ would be readable for all.

I’m just wondering if this approach is ok or if there is a better one.

My concern here is that, in order to keep consistency and be easily manageable, the folder structure within my private and public folders is the same. That way I can store relative paths in my DB, and move the files from public to private without having to rename the file path in my DB.
As a result, visitors can view a part of my private/ folder structure, since it’s similar to the public/ one.

What’s your opinion on this?

Answer 1

I’m not sure I understand your problem, but having the same structure in both directories and needing to easy manage the files within them, I would put all the files in the same directory, denying the access to them from outside the server, and manage the file permissions (public or private) to download from outside with a server script. So, through that server script we could download the file if we are identified, may be by asking the script to copy that file to a temp directory that it’s 777, or may be we could make the script to send us the file directly , like it does with the html.