Question

Lets say I have some pdf files stored on my server and I only want to allow a person who’s paid have access to download a particular pdf.

So for an example, let’s say I have a bunch of e-books. The only way a user would be able to download e-book A is if his account contains the right credentials for that particular book.

What’s the best way to accomplish this?

Any ideas/advice on how to improve my idea are greatly appreciated!

My current idea:

• A user places an order

• Upon success, a new folder would be
  created by their
  /account_num/order_id/ A copy of the
  particular file would be stored in
  this directory

• Have php generate an .htaccess that
  would only allow access from a url
  that contains a random hash embedded
  into it.
• The only way a user would be able to
  access this random hashed page is if
  they are signed in as the right user,
  and the hash matches up with the hash
  stored in the database, otherwise
  they are redirected to home page.

Answer 1

Store the PDFs below the document root. When someone wants to download say, A.pdf, direct them to a PHP page like: download.php?file=A.pdf. Write that download.php page to check the requesting user’s privileges, and force a download of A.pdf if their privileges are good enough.