php to Allow Download only if session / cookie is active

Question

I have provided a straight download link in my site as below.

<a href="myfile.pdf">Download here</a>

This file is accessible to every one. But i want to restrict this based on logged in users.

Say an user have an active session / cookie upon successful login as below.

$_SESSION['login'] = 1  or $_COOKIE['login'] = 1

even if set following condition, people can manually type http://web.com/myfile.pdf and able to download the file...

if($_SESSION['login']===1 && $_COOKIE['login']===1){
    echo '<a href="myfile.pdf">Download here</a>';
}

Other Anonymous users should not be able to access the file.

Use an if statement to check the session/cookie and output accordingly — ElefantPhace, Feb 12 '14 at 18:15
Create a php script that checks the session variable, reads the file and sends out force download headers. There are a thousand articles on SO about how to do this. — Jonathan Kuhn, Feb 12 '14 at 18:15
@ElefantPhace : even if set, anyone can manually type the link and get the file — logan, Feb 12 '14 at 18:15
@JonathanKuhn : how should i make it "on click" without reloading ! — logan, Feb 12 '14 at 18:24
When you click the link, it goes to the php script for the file and if the download is authorized, a download dialog pops up. The user doesn't see the next screen as a page. They automatically stay on the same page. — Jonathan Kuhn, Feb 12 '14 at 18:33

Calvin K · Accepted Answer · 2014-02-12T18:36:52.740

5

If it were me I would use something like this to hide the link entirely from the not logged in users

if($_SESSION['login']===1 || $_COOKIE['login']===1){
    echo '<a href="myfile.pdf">Download here</a>';
}

If you are looking for specific download denying based on the session after the link is clicked, you will have to setup some type of script to handle the above code and return the file you want.

EDITED:

OK, then link it to a script that retrieves the file from a non-accessible location and feeds it back with the same if/then statement.

Something like

filedownload.php?filename=foo.bar

And then filedownload.php would look something like this.

<?php
session_start();
if($_SESSION['login']===1 && $_COOKIE['login']===1){

$file_dir = "/some/dir/";
$file = $file_dir . 'foo.bar';

if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);
    exit;
}
} else {
    echo "You need to login to download this file.";
}
?>

This was copied directly from the PHP manual. And added the if/then statement.

edited Feb 12 '14 at 18:36

answered Feb 12 '14 at 18:15

Calvin K

396
2
6

even if set, anyone can manually type the link and get the file – logan Feb 12 '14 at 18:17
it says, Warning: Cannot modify header information - headers already sent – logan Feb 12 '14 at 18:30
3

@logan, that script should be the only thing in the entire page. Nothing else. Not even a space before ` – Jonathan Kuhn Feb 12 '14 at 18:35
then you must have something else wrong with your script. This checks if the session and cookie are set. If so, downloads the file, if not, shows the error message. Make sure you used session_start(); on the filedownload.php file. – Calvin K Feb 12 '14 at 18:36
@JonathanKuhn : it works now.. but what if want to display some custom text in the page ? – logan Feb 12 '14 at 18:38
1

You would want to display the text on another script and use something like a meta refresh or javascript to forward the user to the download page. You can't display a message on the same page as the download script because anything output before the header will throw an error and anything output after the header will be included in the downloaded file. – Jonathan Kuhn Feb 12 '14 at 18:42
If you don't mind, please change your downvote to an upvote if this solved your question. – Calvin K Feb 12 '14 at 18:44
@CalvinK : Thanks :) I have done it., but there is no need to downvote my question as well !! because i have explained it well; you can remove downvote! – logan Feb 12 '14 at 18:49

php to Allow Download only if session / cookie is active

1 Answers1