防止共享下载URL

Question

Problem

When I offer a download to a user, I don't want them to be able to copy the URL and share it with others. To go even further: I would like to give out the download only once. If they access the URL a second time, I'd like to throw a 404.

Question

How can I prevent a user from accessing the download URL a second time and is this method full proof.

Additional information

I currently serve my file as follows:

header("Content-type: application/pdf");

// Set the name of the downloaded file here:
header("Content-Disposition: attachment;filename='example.pdf'"); 

 // Get the contents of the original file:
echo file_get_contents('example.pdf');

I've also added a table to my mysql database

+----+------+-------+------+
| downloads                |
+----+------+-------+------+
| id | file | token | flag |
+----+------+-------+------+

Answer 1

You would need to use a download script which redirects to the file. The script would need to verify the url via a unique token (stored in a database) before redirecting to the file. The script could record a download has been made and set a flag in the database. Check the flag to prevent future downloads.

EDIT: Here's an Example (with pseudocode):

if( isset($_GET["token"]) && !empty($_GET["token"]) )
{
    //verify $_GET["token"] matches a token in the db

    //verify that the download flag has not been set

    header("Content-type: application/pdf");

    // Set the name of the downloaded file here:
    header("Content-Disposition: attachment;filename='example.pdf'"); 

    //set the downloaded flag in the database so that this file can't be downloaded again

     // Get the contents of the original file:
    echo file_get_contents('example.pdf');
}
else
    header("HTTP/1.0 404 Not Found");