Secure document storage area

I can secure the user interface - what about files themselves?

[deejay]

I’m building a secure document storage area on back of our website for our company. I’ve got the php/mysql side of it pretty much covered – user permissions, file upload and categorization, etc.

Question is though, how do I protect the documents themselves from being accessed directly via the file location.

Say a file is uploaded to www.example.com/secretstorage/itsasecret.doc

I need a way to stop the user just bookmarking that location and going through the back door, so to speak, or worse – passing the URL on to others.

Of course I’ll disable indexing on the /secretstorage/ directory so they can’t just drop the document name and get a list of files.

I really want more than that though. In other simpler projects I’ve just used .htaccess to protect directories with usernames and passwords, and that’ a possible. I’d want to avoid users having to enter a username and password to get into the directory after they’ve already logged into the front end though. Is it possible to pass the username and password to the server somehow without the user having to enter it?

I know this maybe isn't strictly a php mysql question, but that's my main platform so thought best to pop the post here.

I may, of course, be barking up entirely the wrong tree method-wise – would appreciate any and all suggestions on ways to handle this.

[Sagaris]

I think the easiest way to acheive this is to store any download files outside of the web root. This way the PHP scripts are still able to access the files so they can be provided as a download but a user is unable to enter a path directly to the file.

[joelgreen]

Agree, you should put files outside web root. But then you have to send file with php, setting correct header info. For example

header('Content-type: application/msword'); // this will vary
readfile('file-path-here');
...

Google for something like php file download hide real path to find how others are doing it with php