Question

you know on YouTube, once you uploaded a video, it would ask you to make it either public or private. public being that it is accessible by any. private being accissible by only you the original uploader and you have to be logged in to do so, too. I need to make something of the same kind as that. I am making a rails app that uses QuickTime progressive download instead of Flash, so basically I use an embed tag with the src pointing to some dns/video.mov. But I can’t possibly let the videos be on the public domain. What can be my options on top of your head?

Answer 1

Create a session cookie when the user logs in. This cookie usually contains a session ID of some kind (a long string). Attach that ID to the URL of the movie as a query (.../video.mov?ID=2387543462578).

That way, your server can check the ID against currently open sessions. If the ID isn’t valid, reply with a 403 (forbidden).

[EDIT] Since you put the file into Rails_root/public/videos, Ruby automatically handles the download to the browser for you. This is the default behavior for any file put in the public folder. What you need is to put the files in a different place and handle the downloads manually. Check the Ruby sources and look for the handler for the public folder; this should give you an idea how it works under the hoods. You should be able to extend this class with some additional code to check whether the user can actually download the file.