Question

I have a massive of scripts that my core application

    include('JS/gramp.php');
    include('JS/est.php');
    include('JS/curest.php');
    include('JS/memomarker.php');
    include('JS/local----------.php');
    include('JS/poirel.php');
    include('JS/maplayers.php');
    include('JS/trafficinc.php');
    include('JS/plannedtraffic.php');
    include('JS/transportissues.php');
    include('JS/cams_traff.php');
    include('JS/places2.php');

Now these are all being moved to a on the fly loading, to reduce the size of the application on load

if(button_case_curtime==true){
        $(".jsstm").load("<?php echo $core_dir; ?>JS/curresttime.php?la=<?php echo $caseset['iplat']; ?>&lo=<?php echo $caseset['iplong']; ?>&h=<?php echo $days_h; ?>");
        rendermap = true;
        }

issue! the application requires these files to be secure, the data involved requires that no one can access.

The ONLY file that will ever request these files will be index.php

Any input or idears would be fantastic!

Answer 1

There is no way to provide a file to the browser without also providing it to a user.

You could configure your server to only supply the files given an extra HTTP header (which you could add with JS), but nothing would stop people from sending that header manually or just digging the source out of the browser’s debugging tools.

Any user you give the files to will have access to the files. If you want to limit which users have access to them, then you have to use auth/authz (which you’ll want to apply to the index.php file as well so that unauthorised users don’t just get JS errors or silent failure states).