Welcome! Log In Create A New Profile

Advanced

RE: Prevent direct access to files but allow download from site

Reinis Rozitis
March 12, 2020 06:32PM
> The user MUST BE ABLE to download the file from the article pages when
> LOGGED.
> If the user is NOT LOGGED, he cannot download the file, therefore even
> recovering the url, he must receive an error or any other type of block.

It's rather difficult to achieve that only with a webserver (as typically a webserver itself has no idea about users being logged in or out and just to rely on a cookie is possible but rather weak check).

While you can use the secure link module (https://nginx.org/en/docs/http/ngx_http_secure_link_module.html ) with expiration a more common way would be to implement the download check in the application itself and use the nginx X-Accel-Redirect feature - https://www.nginx.com/resources/wiki/start/topics/examples/xsendfile/

Without knowing what kind of app (php/python/js/perl etc) are you running it's hard to give an exact example but the gist of the idea is to:
- place the files outside webroot
- configure the path as an internal nginx location
- the application then checks if the user has an active session, then sends the X-Accel-Redirect header with the particular file to nginx which sends the file to user.

There should be plenty of samples on internet.


rr

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

Prevent direct access to files but allow download from site

MAXMAXarena March 11, 2020 06:36PM

Re: Prevent direct access to files but allow download from site

Ralph Seichter March 11, 2020 06:58PM

Re: Prevent direct access to files but allow download from site

gariac March 11, 2020 08:46PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 11, 2020 09:23PM

Re: Prevent direct access to files but allow download from site

gariac March 11, 2020 10:20PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 05:49AM

Re: Prevent direct access to files but allow download from site

Ralph Seichter March 11, 2020 10:22PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 05:47AM

Re: Prevent direct access to files but allow download from site

j94305 March 11, 2020 10:36PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 07:42AM

Re: Prevent direct access to files but allow download from site

j94305 March 12, 2020 06:03PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 13, 2020 09:20AM

Re: Prevent direct access to files but allow download from site

lsces April 05, 2020 11:42AM

Re: Prevent direct access to files but allow download from site

J.R. March 12, 2020 12:02PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 01:12PM

RE: Prevent direct access to files but allow download from site

Reinis Rozitis March 12, 2020 06:32PM

Re: Prevent direct access to files but allow download from site

Ralph Seichter March 12, 2020 08:18PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 59
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready