On the current website I’m working on, I’ve got a directory of files for users to download which would be really nice to have some security method other than obscurity 😉
I was wondering if there’s any way to supply login information via PHP to htaccess as though a user were entering it.
Alternately, if anyone knows a better way to secure user downloads using PHP, that’s also acceptable. All of my googling turns up ‘just use htaccess’ which isn’t really helpful, as from the non-savvy user’s point of view, they have to log in twice every time they use the website.
My best guess at doing it exclusively with PHP is to store files above the web root, then copy them to a web accessible folder temporarily, but this seems highly inefficient and I couldn’t think up any way to remove them after the download has finished.
Note: I don’t own the server this is running on and don’t have ssh access to it.
If files are not too big (Gb) you can always use readfile for file’s download. In this mode you can check user’s auth before, and if it’s ok output file contents to user, otherwise send him to login page.
With this method you can put your files in protected (with .htaccess) directory so you can be sure that nobody who isn’t authenticated can access them.