How to protect from direct downloads?

Regular Joined: Sep 25, 2006 Posts: 57

Happy holidays!

How do I protect my downloads from direct access on my hosts server? I want registered users to be able to download but I dont want anyone who gets the URL to be able to access the file directly, bypassing registration/login to the site.

Posted: Thu Dec 27, 2007 5:28 pm

let me guess NSN downloads.

are we allowed to answer our own questions Wink

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Answer away! Laughing

Actually that will not circumvent the root issue but it will make it more difficult. There are various strategies and different implementation techniques that you will find by searching the forums here and Google. If I have the url, NSN will not stop me from accessing it outside of nuke. NSN will only work if I am trying to get the file through your Downloads module.

If you are using Apache, then to lock the files you will need to use Apache directives in .htaccess to protect the access to the folder/files and then meld that into your nuke code. In other words, only allow access through Apache if certain environmental settings are present and make sure the only way they get set is through the registered user's access in nuke.

registered · Posted: Fri Dec 28, 2007 9:18 am

Download leaching was addressed in a long thread almost two years back. Here I discuss the approach if you are using NSN GR Downloads and gotcha addressed the idea up further in the thread:

http://www.ravenphpscripts.com/postp60755.html#60755

Have fun!

registered · Posted: Mon Dec 31, 2007 11:02 am

We have this working 100% in Evolution. If you want I can give you the module to take a look at. The only thing that would be an issue would be caching, everything else should be fine.