Protecting media files 1

[OsakaWebbie]

I have a private (small number of users) PHP-MySQL site that uses session authentication, and I want to offer MP3 files to be accessed by users only (I'll put them on pages via embed tags with mini-controls that the users can play). But how do I keep the media files themselves from being accessed directly by non-authenticated people? I found a few others who have asked this question (or something similar), but I didn't see an answer that completely satisfied me. These are three suggestions I saw:

1) Use HTTP authentication (.htaccess) on the directory where the media files would be - I haven't seen anyone suggest how to avoid the users having to log in twice, and me having to maintain two lists of users/passwords (DB and htpassword).

2) Place the files outside the web tree and use passthru or readfile to serve them - as far as I can tell, that would not allow me to embed the audio on a page with HTML, but only to serve the binary file directly with the appropriate Content-Type - not what I want.

3) Keep the permanent files outside the web tree and make a randomly named copy in the web tree when needed - pretty cumbersome, especially regarding deciding when and how to delete the temporary files later.

Are there other, simple but effective ideas? Or ways to overcome the problems in one of the above methods?

 

[jpadie]

as an aside - has anyone thought of podcasting sermons yet?

a test version of the code will be up on my servers in about 20 minutes. look for it at

http://www.tmogolf.co.uk/tektips/osakawebbie/index.php

 

[OsakaWebbie]

as an aside - has anyone thought of podcasting sermons yet?

Sure, many have, including my own husband (putting his up would be another project for me, and I have other projects that are more urgent). One group of churches that has been putting more media on the web than perhaps any other is Calvary Chapel (and I also think their teaching is good) - here is their podcast page:

http://calvarychapelpodcasting.com/

But before we get in trouble for being off topic, let's get back to the issue. I tried your code in four browsers (IE and Firefox on two machines), and got four different behaviors, so this browser weirdness is getting stranger and stranger. I wonder if manually sending binary content like this, especially inside an embed, is pushing the limits of the technology somehow...? I'm working on other parts of my code for now - if this gets solved, great; but if not, no sweat.