JSP to disable link to pdf when user not logged in

Where should I put pdf file?

[pouneh]

I have a web app which has a link to a pdf format user guide.
I want to be able to disable access to this pdf when the
user has not logged in. So in my jsp file which has the
link, I check a session variable and disallow user to
follow the link, if they are not logged in. The pdf file resides
in the same directory as my .jsp files. There's currently
nothing that stops the user from accessing the pdf URL
directly. How can I implement something which will not allow
access of the pdf unless the user is logged in?
Thanks so much
Pouneh

[dmorison]

If you have sufficient access to your server you could implement this by keeping the PDF document outside of the document root and using a script to serve the file rather than serving it directly.

What you need to do is create a .jsp script that reads the contents of the PDF and returns it to the client; along with the appropriate HTTP headers that inform the client that it is receiving a PDF document.

If you can't store the .pdf anywhere other than a public directory then you could use a bit of "security through obscurity" and keep it in an impossible to guess filename. You don't link to this filename; you serve it via a script as in the above example.

[pouneh]

dmorison, thanks so much for the prmopt reply.
Pardon my ignorance, I'm a novice at this. I am
using struts. Can you tell me how exactly I would serve
up the pdf?
Thanks a million
pouneh