1

I'm a Linux newbie. I have a PHP script which, based on the correctness of a few parameters, decides whether to serve a file to the user or not. I'm serving files through the XSendFile feature in nginx. I'd like to block direct access to files so that the user is forced to download them through the PHP script.

My problem is that if I set the files permissions to 640, when I try to download directly I get a 403 Forbidden, but I'm unable to download it with the script as well. Whereas if I set it to 644, I'm able to do both things (I thought one needed to add the Execute permission to enable direct download of a file. Was I wrong?) How should I setup permissions to achieve what I need?

Edit: Note that I can't move the files above the web root directory, because some files must have direct access while others must not. So I have to keep them all in the same directory and be able to enable/disable direct downloading selectively.

Improve this question

1 Answer 1

Reset to default
1

Nginx has a directive for that. You may mark a location as "internal" which means Nginx processes it only as a result of rewrite, X-Accel-Redirect and alike. If you'd try to request this location directly, you'll get 404 "Not Found" response.

location /downloads {
  internal;
}

location /scripts {
  # should issue X-Accel-Redirect: /downloads/file.ext
}
Improve this answer
1
  • 1
    Yeah, I eventually figured that out. The problem is, as some files should be directly downloadable and some should not, I can't really do that. So, I think I'll adjust my needs and make two different folders. Thanks anyway. I'll accept the answer because it will help others who don't know about the internal directive.
    – ySgPjx
    May 19, 2011 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .