How to hide the source of a download on a webpage

I'm looking for a way to hide the source of my download. I'm surprised this is not more covered, but it also makes me wonder whether it's possible.

(Edit: By hide I mean make it difficult or impossible for end user to find a direct link to the file. They will thus be forced to actually be on the page, clicking it, for it to work.)

I found a script to force download files that are locally stored. The way I see it, it hides the true source (at least it's not in view source or download history).

http://w-shadow.com/blog/2007/08/12/how-to-force-file-download-with-php/

So this works, I made it into a function that gets a linkID, and check that with a DB for the actual file-source. Hooray!

Only what if your downloads are on another server? Then you can't use most of the functions used here (like filesize, isreadable, fopen, ...). I'm not proficient enough to decide whether it is possible/feasible to make this work cross-server.

I realize that probably my webserver will lose bandwidth even though files aren't stored ther开发者_如何学Pythone, that's not a big issue.

Any info on the subject would be greatly appreciated. I prefer PHP, but I can work with whatever you give me, I really have no idea about this one.

You mean you want to hide the path of files stored on your server? If this is the case, simply store the files outside of your web root, and serve the files with a PHP script which will make use of readfile() + header() of appropriate headers depending on whether you are serving the file for opening or forced download. See http://php.net/readfile for plenty of examples on forced download scripts.

Sorry not possible. You HAVE to tell the browser where the resource is located so any savy user can simply decode the address or scan the HTTP request or their firewall logs or download history in the browser.

If you're trying to hide the path on your server then URL rewriting with mod_rewrite or aliases or other similar method should be sufficient.

UPDATE: Ok if using your own bandwidth is not an issue then all you need to be doing is outputting the files binary content to the browser and setting the relevant HTTP headers (ie, Content-Type and Content-Disposition). If the files MUST be stored remotely then you'll need your script to download and read them on-the-fly using CURL or similar before outputting the content.

If you mean hide the script or the directory the file is coming from, it's a simple answer--you can't.

BUT, you can make it only accessible on your terms, like using a script to render the file (as you have) but only when specific criteria are met. Alternatively you can move the file to a temp/secured directory and allow them direct access, but this also means waiting for the move, providing (what is deemed) reasonable and fair time to download the file, then removing it/deleting it when it's done.

You could use cURL to serve as a pass-thru for the content. This would conceal the source of the actual data, and allow you to secure it any way you choose. It would also take a lot of bandwidth, roughly 2 times the size of all downloaded files.

Give this a shot and let me know if it works?

if ($passesallyoursecurity) {
    set_time_limit(0);
    header("Pragma: public");
    header("Expires: 0"); 
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); 
    header("Cache-Control: private",false);
    header("Content-Type: application/download"); 
    header("Content-Disposition: filename=filetheyget.ext");

    $ch = curl_init("http://remotedomain.com/dir/file.ext");
    curl_exec($ch);
    curl_close($ch);        
    exit();
}

I would recommend that you use a die() message without any HTML, whatsoever. in the document.

Then, insert the IP Addresses you want the webpage to decline. I would break the IP Addresses you don't like in an array(). Then use an "if" construct to see if any of those IP Addresses are lurking.

$decline_ips = array('ip_1' => '127.0.0.1');
if ($_SERVER['REMOTE_ADDR'] == $decline_ips['ip_1']) {
   die("You aren't permitted direct access to this page.\n\n\n\n
   Sources are blank.");
}

It works like a charm! And for XTRA-XTRA security, I would recommend inserting the IP address that isn't allowed (when they visit) to the Database so that whenever they try again, both the source is covered and the entire document.

But, you can just use the script I have posted on a different part of the document.