Question

I want to serve some confidential files to authenticated and authorized users. The PHP part is working well, and currently the PHP script outputs the file contents with the appropriate content types. However, some files are really large, thus, I’d like to have the HTTP Daemon to do the serving process and just “ask” PHP first if the user can get the file. How would I do this?

Answer 1

For lighttpd: http://redmine.lighttpd.net/wiki/1/X-LIGHTTPD-send-file

For apache aditional mod is required: https://tn123.org/mod_xsendfile/

Usage will be like this:

$status = authorization();

if($status){
    $file = '/tmp/bigfile.dat';
    header("X-Sendfile: $file");
    header("Content-type: application/octet-stream");
    header('Content-Disposition: attachment; filename="'.basename($file).'"');
}

If using Apache, make sure you also turn on XSendFile in your Apache configuration. Otherwise, you will be serving empty files. For example:

<Directory /var/www/>
    Options Indexes FollowSymLinks MultiViews
    XSendFile on
    AllowOverride All
    Order allow,deny
    allow from all
</Directory>