File security question

[Naoise]

Workflow
- User wishes to purchase a file
- User goes through credit card process.
- Upon successful transaction, redirect user to download file

What would be the best way to do this and ensure that :

a) a file is only available to those who have paid. Can manage
via session value but file can still be linked to in a directory.

b) a file cannot be linked to directly via HTTP (I accept
a downloaded file can be copied, just don't want HTTP link
posted on a forum)

c) directory content cannot be grabbed via *nix wget command

*Note : Shared Hosting environment

 

[jpadie]

put the files in a directory outside the webroot or, if impossible, under the root with an .htaccess directive of DENY ALL

store a pointer to the file location in a database.

use a script to proxy the file download after verifying the user's right to download it. do this, simply, by setting the right headers for the file and then using readfile() to send the file to the client.