您通常如何保护您网站的高级版块？

Question

I have a uploads folder under my website folder root. They contains mp3s. Now this folder should only be accessible once the user has completed paypal payment for that particular mp3 i.e once the payment is complete, the download link should be emailed to them and they should only be able to download from that link.

I don't need any code extra but I just a general strategy of how such websites protect their premium content?

I am using PHP but you can provide strategy in Asp.Net too if that's more comfortable to you.

Answer 1

You should just not store the MP3 files in a location accessible from the outside. Instead, the link you give to the user should be a link to a page (PHP or anything) which will

1. verify that the user has the right to access the resource
2. stream the asked resource to the user

Something like

download.php?mp3FileId=5435

The download.php will check if the user is authenticated and has paid for the file 5435, then read this file from a protected resource, and stream it to the HTTP response, with the appropriate content type set.