如何将apache上的某些文件限制为经过身份验证的用户？

Question

In a site which uses a normal, cookie-based authentication where the password is stored on a cookie, is there a way to serve files only for users that are already logged in?

Answer 1

Short answer: No.

Long answer: You can write an authenticated application where the user has to login and then the application manages the compilation of headers and whatnot for the user to access a given file. For instance, if your users need to download a PDF or something you can send pdf headers and then send binary data; they won't be able to see what file on the server you're serving up. Downside is that this is slower than just pushing them a file from the filesystem or a CDN.

Also, don't store the password in the cookie. Create a hash or something you can access and validate again, but password in cookie is just a bad idea; those guys are plaintext!