Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have a website, some folders on the websites contains images and files like .pdf , .doc and .docx . the user can easly just type the address in the url to get the file or display the photo

http://site/folder1/img/pic1.jpg

then boom.. he can see the image or just download the file

my question is: how to prevent this kind of action, how can i guarantee a secure access of the files.

any suggestions

UPDATE TO CLARIFY MY IDEA

i don't want any user who is browsing the website to get access to these files normally by just writing the URL of the file. those files are a CV files, they are being uploaded by the users to a specific folder on the server which we host outside the company. those files are only being viewed by the HR people through a special system. that's the scenario we want. i don't want a WEB GEEK who just wants to see what files has been uploaded to this folder to download them easly to his/her computer and view them or publish them on the internet. i hope you got my idea

share|improve this question

migrated from stackoverflow.com Sep 16 '12 at 1:39

This question came from our site for professional and enthusiast programmers.

    
The link doesn't work. –  Stefan Kendall Sep 25 '09 at 18:07
    
it's just a demonstration link.. it doesn't exist –  bogha Sep 25 '09 at 18:23
    
It is better to provide information on how normal users of the system gain access to the files. That would you will get a more specific answer. If you have files that user X has access to, but Y should not, then the answer will be different. –  Vineet Reynolds Sep 25 '09 at 18:34
    
i don't want any user who is browsing the website to get access to these files normally by just writing the URL of the file. those files are a CV files, they are being uploaded by the users to a specific folder on the server which we host outside the company. those files are only being viewed by the HR people through a special system. that's the scenario we want. i don't want a WEB GEEK who just wants to see what files has been uploaded to this folder to download them easly to his/her computer and view them or publish them on the internet. i hope you got my idea –  bogha Sep 25 '09 at 18:45
    
Yes, it is more clear now. Please update the question so that people dont have to find your intentions of asking so, in the comments. –  Vineet Reynolds Sep 25 '09 at 19:00

3 Answers 3

up vote 1 down vote accepted

You can store the files being uploaded into a directory outside your web application, so that it is not directly accessible via a URL; this will ensure that the web server will not serve these files via a requested URL.

When you have to serve these files, ensure that the user who has requested for the file does have access to it. In other words, check if the user is authorized to view the files - you might want to authorize the original user who uploaded the file and the HR users to have acccess to the file.

Since the web server does not have direct access to the files, preventing it from serving them, you will have to write a server-side script in a language of your choice (PHP/ASP/JSP etc. since you didn't indicate any) that will upon post authorization checks, retrieve the file and serve its contents to the user.

share|improve this answer

To increase the security of your files you can put them in a directory outside the webroot, and then stream them to your webpages via a script. On top of this, the script that streams them has to be on an access controlled page. You can use .htaccess but I prefer a more flexible login system.

share|improve this answer
    
i will keep this option as a secondary solution if there is no other option. thanks –  bogha Sep 25 '09 at 18:46
    
this is the only reasonably secure approach. To elaborate, you could have a PHP script or something similar that opens the file and writes its content out to the web request, thus never exposing the actual file to the web. The script and/or web server would be responsible for checking the user's credentials. –  rmeador Sep 25 '09 at 18:47

You can check the HTTP Referrer header as a way of checking that the link came from your site. Note that the referrer can be faked, but if you're just looking for a simple way to catch most folks, this does work.

share|improve this answer
1  
You can make it so that referrer needs to have a session token in the url, making it more difficult to fake. –  Ben S Sep 25 '09 at 18:12
    
i really didn't get your point. can you give me an example. when the user types the full path of the file " pdf or image " then the image will be displayed and the file will be downloaded directly, i don't think there are some kind of page that is going to be executed. am i wrong ? –  bogha Sep 25 '09 at 18:28
    
Good answer, however for advanced system admins only. –  BryanH Sep 13 '12 at 22:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.