4

If I upload files to my server and thus have clients/customers download these files. How may I restrict the access of the file?

Such as, if I upload a file to www.domain.com/files/download.zip

And if the user has correct permissions he can download the file, but what if the user knows the direct link to the file itself?

Cause I can imagine how to not show the link to the user on the site if they don't have permission to see the link, but how do I prevent someone from just typing in the direct URL of the location of the file to download the file?

Thanks in advance.

RoR
  • 15,934
  • 22
  • 71
  • 92

1 Answers1

7

Don't put those uploads in /public if you want to secure them. Keep them in a folder outside of your web root, then have a controller that uses send_file to allow them to download the file if authorized.

Matchu
  • 83,922
  • 18
  • 153
  • 160