允许在PHP中为网站安全下载

Question

I have uploaded some zip files to my server and now want to allow a user to download them if he/she has an appropriate password. I'm coding in PHP and I've made it so a user cannot access the page with the links to zip files unless the proper password has been entered, but by having a link to my zip file the user could just see and in future cases type in the absolute location of the zip file and bypass my password checks. If I change the file permissions on the zip file then I can't have it as a link because the user won't be able to access it. How can I allow the user to get the zip file while still keeping it secure? Any suggestions would be much appreciated.

Answer 1

The best way to do this is to mask url.

• user logins
• generate a token based on his login details. some md5 or whatever you decide
• create a download link (eg: download.php) that load the file based on valid token and session and get's the file with file_get_contents().