4

If I upload files to my server and thus have clients/customers download these files. How may I restrict the access of the file?

Such as, if I upload a file to www.domain.com/files/download.zip

And if the user has correct permissions he can download the file, but what if the user knows the direct link to the file itself?

Cause I can imagine how to not show the link to the user on the site if they don't have permission to see the link, but how do I prevent someone from just typing in the direct URL of the location of the file to download the file?

Thanks in advance.

RoR
  • 14,904
  • 22
  • 67
  • 92

1 Answers1

7

Don't put those uploads in /public if you want to secure them. Keep them in a folder outside of your web root, then have a controller that uses send_file to allow them to download the file if authorized.

Matchu
  • 80,913
  • 16
  • 150
  • 159