2

i have a website, some folders on the websites contains images and files like .pdf , .doc and .docx . the user can easly just type the address in the url to get the file or display the photo

http://site/folder1/img/pic1.jpg

then boom.. he can see the image or just download the file

my question is: how to prevent this kind of action, how can i guarantee a secure access of the files.

any suggestions

UPDATE TO CLARIFY MY IDEA

i don't want any user who is browsing the website to get access to these files normally by just writing the URL of the file. those files are a CV files, they are being uploaded by the users to a specific folder on the server which we host outside the company. those files are only being viewed by the HR people through a special system. that's the scenario we want. i don't want a WEB GEEK who just wants to see what files has been uploaded to this folder to download them easly to his/her computer and view them or publish them on the internet. i hope you got my idea

6
  • The link doesn't work. Sep 25, 2009 at 18:07
  • it's just a demonstration link.. it doesn't exist
    – bogha
    Sep 25, 2009 at 18:23
  • It is better to provide information on how normal users of the system gain access to the files. That would you will get a more specific answer. If you have files that user X has access to, but Y should not, then the answer will be different. Sep 25, 2009 at 18:34
  • i don't want any user who is browsing the website to get access to these files normally by just writing the URL of the file. those files are a CV files, they are being uploaded by the users to a specific folder on the server which we host outside the company. those files are only being viewed by the HR people through a special system. that's the scenario we want. i don't want a WEB GEEK who just wants to see what files has been uploaded to this folder to download them easly to his/her computer and view them or publish them on the internet. i hope you got my idea
    – bogha
    Sep 25, 2009 at 18:45
  • Yes, it is more clear now. Please update the question so that people dont have to find your intentions of asking so, in the comments. Sep 25, 2009 at 19:00

3 Answers 3

3

You can store the files being uploaded into a directory outside your web application, so that it is not directly accessible via a URL; this will ensure that the web server will not serve these files via a requested URL.

When you have to serve these files, ensure that the user who has requested for the file does have access to it. In other words, check if the user is authorized to view the files - you might want to authorize the original user who uploaded the file and the HR users to have acccess to the file.

Since the web server does not have direct access to the files, preventing it from serving them, you will have to write a server-side script in a language of your choice (PHP/ASP/JSP etc. since you didn't indicate any) that will upon post authorization checks, retrieve the file and serve its contents to the user.

3

To increase the security of your files you can put them in a directory outside the webroot, and then stream them to your webpages via a script. On top of this, the script that streams them has to be on an access controlled page. You can use .htaccess but I prefer a more flexible login system.

2
  • i will keep this option as a secondary solution if there is no other option. thanks
    – bogha
    Sep 25, 2009 at 18:46
  • this is the only reasonably secure approach. To elaborate, you could have a PHP script or something similar that opens the file and writes its content out to the web request, thus never exposing the actual file to the web. The script and/or web server would be responsible for checking the user's credentials.
    – rmeador
    Sep 25, 2009 at 18:47
2

You can check the HTTP Referrer header as a way of checking that the link came from your site. Note that the referrer can be faked, but if you're just looking for a simple way to catch most folks, this does work.

3
  • 1
    You can make it so that referrer needs to have a session token in the url, making it more difficult to fake.
    – Ben S
    Sep 25, 2009 at 18:12
  • i really didn't get your point. can you give me an example. when the user types the full path of the file " pdf or image " then the image will be displayed and the file will be downloaded directly, i don't think there are some kind of page that is going to be executed. am i wrong ?
    – bogha
    Sep 25, 2009 at 18:28
  • Good answer, however for advanced system admins only.
    – BryanH
    Sep 13, 2012 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .