ASP - Protect file download

[Laeg]

Architecture
ASP/MySQL db

I want to have an ecommerce site that allows the download of digital data. How exactly could I best go about
protecting this data. Digital data can be copied once downloaded so there is not all that much I can
do there but I am more wondering about how to allow a user download the file but only having paid. Ideally
something like after a user pays they get given an ID and they go to a download centre and download the file.
This file might be available for X hours and then removed. Are there any better ways out there? I'm thinking
of both .txt and .mp3 files. In the case of .mp3, possibly stream the data post payment???, how could I resume if user
got disconnected mid download?

Thanks in advance for replies

 

[Sheco]

How about giving the user a link to a file in an empty "download" folder.

Then you can make a custom 404 error page that is associated with the download folder.

... but your custom 404 is not a plain HTML page but rather it is an ASP script that uses the QueryString values to determine:
a. Which file was requested?
b. Does this user have permission to fetch the file?

So use the QueryString values to do a look up in your database to answer those questions. If the answer is "yes", you fetch the file from a secret location that is accessable to your ASP script but not accessible to a web user. Now use the ADODB.Stream object along with Response.BinaryWrite to send the file to the browser as a byte steam.

 

[gbaughma]

Sheco:

Wow.

That's an interesting piece of logic there....

(that was a compliment, by the way)



Just my 2¢
-Cole's Law: Shredded cabbage

--Greg

http://parallel.tzo.com