# How do you protect files in RoR **URL:** \ **Category:** Rails\ **Created:** [March 27, 2009, 4:45pm UTC](https://www.ruby-forum.com/t/how-do-you-protect-files-in-ror/164078 "2009-03-27T16:45:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![milandobrota](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9fc29f/32.png) [@milandobrota](https://www.ruby-forum.com/u/milandobrota)\ **Post date:** [March 27, 2009, 4:45pm UTC](https://www.ruby-forum.com/t/how-do-you-protect-files-in-ror/164078/1 "2009-03-27T16:45:16Z")
I’m mostly interested in mp3 files. I’m supposed to build a music store app. Where should you keep files (s3?). And what’s more important how do you protect other people from using the same link? I guess you have to generate it dynamically. Is there any other solution or maybe any plugin available? ---
**Author:** ![milandobrota](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9fc29f/32.png) [@milandobrota](https://www.ruby-forum.com/u/milandobrota)\ **Post date:** [March 27, 2009, 4:55pm UTC](https://www.ruby-forum.com/t/how-do-you-protect-files-in-ror/164078/2 "2009-03-27T16:55:50Z")
On Mar 27, 3:45 pm, Milan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I’m mostly interested in mp3 files. I’m supposed to build a music store > app. Where should you keep files (s3?). And what’s more important how do > you protect other people from using the same link? I guess you have to > generate it dynamically. Is there any other solution or maybe any plugin > available? Something like X-Send-File (apache) or X-Accel-Redirect (nginx) allows you to use apache/nginx to do the actual heavy work of transferring a large file to the client, while still letting your rails app control access. These both assume the file is on the same server as the one running your instance of apache/nginx Fred ---
**Author:** ![milandobrota](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9fc29f/32.png) [@milandobrota](https://www.ruby-forum.com/u/milandobrota)\ **Post date:** [March 27, 2009, 7:20pm UTC](https://www.ruby-forum.com/t/how-do-you-protect-files-in-ror/164078/3 "2009-03-27T19:20:50Z")
Frederick C. wrote: > Something like X-Send-File (apache) or X-Accel-Redirect (nginx) allows > you to use apache/nginx to do the actual heavy work of transferring a > large file to the client, while still letting your rails app control > access. These both assume the file is on the same server as the one > running your instance of apache/nginx Use Paperclip, and put the files on a shared mount that all of your servers can see. (If you cluster.) Put the files in a folder named after a hash of today’s date + a salt - a password. Concatenate the date to the password and hash the whole thing, then write a cron that renames the folder every day. Paperclip has an option to set the filesystem path dynamically, like routes.rb. Put the hash into this path, and serve the files freely. Nobody can hot-link them because the hash will change daily. – Phlip ---
**Author:** ![milandobrota](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9fc29f/32.png) [@milandobrota](https://www.ruby-forum.com/u/milandobrota)\ **Post date:** [March 28, 2009, 6:23pm UTC](https://www.ruby-forum.com/t/how-do-you-protect-files-in-ror/164078/4 "2009-03-28T18:23:01Z")
You might be looking for this part of S3: [http://docs.amazonwebservices.com/AmazonS3/2006-03-01/index.html?S3\_QSAuth.html](http://docs.amazonwebservices.com/AmazonS3/2006-03-01/index.html?S3_QSAuth.html) That will let you generate a URL that has an expiration date for a particular file; you may also be able to use Amazon FPS to handle the payment part of the system. * * * On a totally non-Rails related note, I’m still amazed at all the sites that think an “mp3 store” will create lots of revenue. It may bring in a little cash, but ultimately iTunes has a massive lock on the market. See some figures here: > **[Release Your Music Everywhere - No Recurring Fees | CD Baby](https://cdbaby.com/)** > > CD Baby - Independently distribute to Spotify, Apple Music, iTunes, Amazon, YouTube, TikTok, Pandora & more. Make money from your songs worldwide on 150+ trusted platforms. For 2008, iTunes generated roughly 85% of sales. The remaining 15% includes virtually every other major digital download site (Yahoo, Napster, Rhapsody, etc). The only thing that amazes me more than the thousands of tiny mp3 stores is the constant VC attention to the “MySpace music store” thing. What sane user would _ever_ type their credit card info into part of Myspace?? –Matt J. On Mar 27, 11:45 am, Milan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)