Solved

How can I prevent non-logged in users from accessing PDFs/DOCs/Etc.

Posted on 2014-01-09
5
297 Views
Last Modified: 2014-02-20
I inherited various web clients from another developer many years ago.  One client site, that's probably over 8 years old, has some serious security issues.  Recently, a PDF that they thought was only accessible through the client's login, showed up on a Google search, and opened just fine. Since they assumed these could only be accessed when their client's logged in, they're understandably freaking out.

I plan to add SSL so that, at the very least, their login codes are encrypted, I've also added a robot.txt file so they won't index them anymore; however, what is the best way to prevent anyone from entering www.domain.com/pdf/filename.pdf into the browser to view these documents?

The host told me that I'd have to secure that directory with a password, meaning they'd have to log into their account, then add another username/password to open any of these files.  I can't believe this is the answer.  So, I'm coming to you brilliant folks.

Any ideas for how to assure this client that their private documents are private?  Let me know.  Thanks.
0
Comment
Question by:StellaBob
  • 2
  • 2
5 Comments
 
LVL 58

Accepted Solution

by:
Gary earned 500 total points
ID: 39769738
The best security is to have the file outside the root of your site so they are not directly accessible at all
Then when someone needs to access them you can stream the file to them (of course checking they are logged in).
While the file is not publicly accessible it doesn't prevent your server side code accessing it.
Usually your user permissions would extend to one folder above your root, this would normally store other things like webstats etc.
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 39770300
There is no easy answer to your question.  Gary's response is a good one but it requires you to rewrite the code that accesses the files.  It also assumes that you have access above your web root directory which is not true on most shared hosting.
0
 
LVL 58

Expert Comment

by:Gary
ID: 39771211
@Dave
Most shared hosting will give you FTP to a parent folder above your root as this is where your stats etc will be stored - well it has always been the case for me when I have used shared hosting in the past.
0
 

Author Comment

by:StellaBob
ID: 39771486
This particular host does allow access to the parent folder above the root.  Let me see what I can do there and I'll let you know.  Thanks.
0
 

Author Closing Comment

by:StellaBob
ID: 39873894
While I haven't figured out how to code this, I believe this answer would be the best option for me.  Thanks.
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Most MSPs worth their salt are already offering cybersecurity to their customers. But cybersecurity as a service is wide encompassing and can mean many things.  So where are MSPs falling in this spectrum?
Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question