473,667 Members | 2,760 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

BIG security problem downloading files....

Mel
on my web site you will have to login to see downloads etc.
However once the user logs in the file url is exposed and the end user can
bookmark the downloadable file and pass it on to others

is there a way to avoid this ?

thanks
Jul 20 '05 #1
2 1407
Mel wrote:
on my web site you will have to login to see downloads etc.
However once the user logs in the file url is exposed and the end user can
bookmark the downloadable file and pass it on to others

is there a way to avoid this ?


Yes.

Do you run your own server?
What server is it?

On my church site [1] I have a load of member-only pages. I use PHP
authentication [2], with each protected page checking the authentication
and backing out if not authorized. This means I don't need to set
cookies on the users' machines.

Documents are done with a PHP script that checks authorization: if OK,
it sends the appropriate headers then reads the document contents from a
separate directory that isn't part of the website directory structure.

[1] http://billericaybaptist.net/
[2] http://www.php.net/manual/en/features.http-auth.php

--
Mark.
Jul 20 '05 #2
Mel wrote in
<c8**********@s 0b1a68.ssa.gov>
on my web site you will have to login to see downloads etc.
However once the user logs in the file url is exposed and the end
user can bookmark the downloadable file and pass it on to others

is there a way to avoid this ?


..htaccess password protection will stop access to the files by anyone who
isn't authorised - whether they know the URL or not.

--
PeterMcC
If you feel that any of the above is incorrect,
inappropriate or offensive in any way,
please ignore it and accept my apologies.

Jul 20 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

3
7854
by: Philippe Lemmerling | last post by:
I have a question concerning security of my file upload script. I'm using the php upload routines (move_uploaded_file,...) and variables ($_FILES) to upload images to a webdirectory. Everything works fine, meaning that I can upload images BUT only if I change the permission of the directory to which the uploaded images are moved to 777. I guess that this is not such a good thing from security point of view. So here are some questions I...
0
1314
by: Yannick Bétemps | last post by:
Hi all, As says the topic, I recently encountered problems with customers using one of my file management applications and being protected in the same time with Norton Internet Security firewall. When the Security is not activated, downloading files works fine, but as soon as it is activated they can not download anything bigger than 500kb ! I checked in the source code, and whatever the method to read the file on the server (readfile,...
4
6981
by: RJ Dake | last post by:
Having problems with uploaded Database and SharePoint sites. At least one of the errors is mentioned below. Sites do not allow access to DB entry or results. Email feedback is MOST appreciated! Thanks, RJ Error message is as follows:
2
3929
by: Fran Tirimo | last post by:
I am developing a small website using ASP scripts to format data retrieved from an Access database. It will run on a Windows 2003 server supporting FrontPage extensions 2002 hosted by the company 1&1 with only limited server configuration via a web based control panel. My query relates to the ASP security model and how it relates to FrontPage options for setting file access on a database file. If you know of any online documentation...
2
1801
by: travelling_nerd | last post by:
Folks: I have some zip files I'd like to serve to authenticated users on my site, but would like to prevent unauthorized users from using an absolute path to get to these zip files. For example http://blah.com/file.zip should not be accessible directly without authenticating. However, my current authenticaion goes to an LDAP server and I'd rather not prompt users for another username and password.
1
1213
by: dhnriverside | last post by:
Mornin peeps. We're in the process of creating a legal music downloading service. Fairly simple. People can either buy 1 track or a number of "credits" to buy several tracks. My concern is how do we secure the actual MP3 files on the server, to make sure people pay for them before downloading. Obviously, they have to be in a directory somewhere, so I how do I protect that direct from just being navigated to from IE / ftp? Is there...
1
2069
by: just.starting | last post by:
Hi, My dot net client downloads files and checks for any new files time to time. The server is apache2.0.53 server. So what happens is that my file download thing works fine if I dont try to call any page from the server while downloading. If I try to call a single page while downloading a file then the page request goes time out and the server then closes the existing download stream and the client doestn't throw any exception. So many a...
0
1633
by: just.starting | last post by:
I am having problem while downloading files from an apache server2.0.53 with php4.3.10.While downloading some files it generally stops after downloading some specific amount and then stops downloading with the error message: "the source file could not be read". And the error is not dependent on the size of the file, as I can download a file of 6MB but having problem with a file with 652KB. It always stops after 666880bytes. Thanks.
2
2422
by: Charles Mifsud | last post by:
Hi all, We have an asp.net 2.0 page with a button. On clicking the button we redirect to another page which downloads a file. When we deploy on the web server we are gretting a security warning saying that "Internet Explorer blocked this site from downloading files to your computer. click here for options". Our code is as follows:
25
2870
by: william.hooper | last post by:
here is my form: <html> <head></head> <body> <FORM ACTION="code.php" method="post"> <INPUT TYPE=SUBMIT NAME="arty.jpg" VALUE="Action"> </FORM>
0
8458
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8790
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
6206
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
5677
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4202
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
4372
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
2779
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
2017
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
2
1779
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.