How can I prevent non-logged in users from accessing PDFs/DOCs/Etc.
I inherited various web clients from another developer many years ago. One client site, that's probably over 8 years old, has some serious security issues. Recently, a PDF that they thought was only accessible through the client's login, showed up on a Google search, and opened just fine. Since they assumed these could only be accessed when their client's logged in, they're understandably freaking out.
I plan to add SSL so that, at the very least, their login codes are encrypted, I've also added a robot.txt file so they won't index them anymore; however, what is the best way to prevent anyone from entering www.domain.com/pdf/filename.pdf into the browser to view these documents?
The host told me that I'd have to secure that directory with a password, meaning they'd have to log into their account, then add another username/password to open any of these files. I can't believe this is the answer. So, I'm coming to you brilliant folks.
Any ideas for how to assure this client that their private documents are private? Let me know. Thanks.
I plan to add SSL so that, at the very least, their login codes are encrypted, I've also added a robot.txt file so they won't index them anymore; however, what is the best way to prevent anyone from entering www.domain.com/pdf/filename.pdf into the browser to view these documents?
The host told me that I'd have to secure that directory with a password, meaning they'd have to log into their account, then add another username/password to open any of these files. I can't believe this is the answer. So, I'm coming to you brilliant folks.
Any ideas for how to assure this client that their private documents are private? Let me know. Thanks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Dave Baldwin
There is no easy answer to your question. Gary's response is a good one but it requires you to rewrite the code that accesses the files. It also assumes that you have access above your web root directory which is not true on most shared hosting.
@Dave
Most shared hosting will give you FTP to a parent folder above your root as this is where your stats etc will be stored - well it has always been the case for me when I have used shared hosting in the past.
Most shared hosting will give you FTP to a parent folder above your root as this is where your stats etc will be stored - well it has always been the case for me when I have used shared hosting in the past.
ASKER
This particular host does allow access to the parent folder above the root. Let me see what I can do there and I'll let you know. Thanks.
ASKER
While I haven't figured out how to code this, I believe this answer would be the best option for me. Thanks.