Question

I’d like to only allow users to be able to click a link once, like this one:

http://www.blah.com/download.php?file=zFZpj4b2AkEFz%2B3O

Each user has an e-mail sent with a unique link and when they click on it I’d like to set a cookie on the SERVER so I know to reject that link’s access again.

Any ideas welcome.

Thank you.

Answer 1

Blocking duplicate download could cause issues (especially with internet explorers file blocker that causes a page refresh).

Cookies are the wrong answer because all the user has to do is use a different browser/machine or clear their cookies to redownload.

If you are desperate to do this how about

On the file system create a symbolic link to the real file and name the link the same as the key.

On processing the page request:

1. validate the url string (to avoid path jumping etc)
2. Check for the existence of this link, if it doesn’t exist link is invalid/expired so show error
3. Otherwise, Copy file to response
4. Delete link