# Offering downloads only to registered users **URL:** \ **Category:** Rails\ **Created:** [April 11, 2006, 1:29pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489 "2006-04-11T13:29:06Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [April 11, 2006, 1:29pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/1 "2006-04-11T13:29:06Z")
I’m writing an app for a blood exam center, where people can go and check the results without going physically there. The customers log in the system and a pdf download is offered to them. The downloads though will not be stored in the db but in the filesystem. How can I allow people to download files only if they’re authorised? I obviously can’t store all the files in /public because once someone figures the naming scheme they’re able to view other customers’ data. Any suggestion? ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [April 11, 2006, 2:12pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/2 "2006-04-11T14:12:13Z")
You’ll need to check if the user is authorized, and then do a send\_file. cheers mat * * * From: removed\_email\_address@domain.invalid [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)] On Behalf Of Giovanni Intini Sent: Dienstag, 11. April 2006 13:27 To: removed\_email\_address@domain.invalid Subject: [Rails] Offering downloads only to registered users I’m writing an app for a blood exam center, where people can go and check the results without going physically there. The customers log in the system and a pdf download is offered to them. The downloads though will not be stored in the db but in the filesystem. How can I allow people to download files only if they’re authorised? I obviously can’t store all the files in /public because once someone figures the naming scheme they’re able to view other customers’ data. Any suggestion? ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [April 11, 2006, 2:15pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/3 "2006-04-11T14:15:24Z")
you have many options: let rails provide the downloads (generally bad idea, but very simple to implement), S3 storage API from amazon, or my preferred solution: Lighttpd with mod\_secdownload. ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [April 11, 2006, 4:55pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/4 "2006-04-11T16:55:38Z")
2006/4/11, Matthias W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > You’ll need to check if the user is authorized, and then do a send\_file. > I didn’t look into send\_file, thanks. ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [April 11, 2006, 4:58pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/5 "2006-04-11T16:58:39Z")
2006/4/11, Roberto S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > you have many options: let rails provide the downloads (generally bad > idea, but very simple to implement), S3 storage API from amazon, or my > preferred solution: Lighttpd with mod\_secdownload. Why do you think sending it via rails is a bad idea? And do you have any pointers to mod\_secdownload documentation? ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [April 11, 2006, 8:24pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/6 "2006-04-11T20:24:28Z")
On Apr 11, 2006, at 4:27 AM, Giovanni I. wrote: > How can I allow people to download files only if they’re > authorised? I obviously can’t store all the files in /public > because once someone figures the naming scheme they’re able to view > other customers’ data. > > Any suggestion? Although probably not the best way, this worked well for me because I had literally thousands of different files which needed authorized access. Each account only had access to a unique subset of those thousands of files, and some files were larger than 1 GB. I was using Apache, so I don’t know how well this will work with lighttpd. This is how I did it: 1. Place the secure files into a private directory. 2. When an account needs access to a file, create a public directory with a unique name (impossible to guess). 3. Create a symbolic link in the new public directory linking to the file in the private directory. 4. When you want the link to expire, just remove the sym link and/or public directory. Of course, this was all scripted so nothing had to be done manually. If you are just dealing with small files or only one file, there are definitely better ways to handle this. Hope that helps. Ryan ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [August 22, 2006, 9:20pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/7 "2006-08-22T21:20:33Z")
Hi, Does anyone know of a library for ruby on rails to integrate S3 storage and only allow authorized downloads? I did a little bit of searching and found rsh3ll for ruby, but didn’t find anyone talking about integrating this with rails. I don’t know too much about S3, but is it possible to grant one of the users of my site limited access to download one file, for say a 24hour period? If anyone has ideas or links to good articles, please send them my way. Thanks. Roberto S. wrote: > you have many options: let rails provide the downloads (generally bad > idea, > but very simple to implement), S3 storage API from amazon, or my > preferred > solution: Lighttpd with mod\_secdownload. ---
**Author:** ![Giovanni\_I](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Giovanni\_I](https://www.ruby-forum.com/u/Giovanni_I)\ **Post date:** [August 28, 2006, 3:46pm UTC](https://www.ruby-forum.com/t/offering-downloads-only-to-registered-users/57489/8 "2006-08-28T15:46:55Z")
Hi, There’s a ruby library available at the aws site: [http://developer.amazonwebservices.com/connect/entry.jspa?externalID=135&categoryID=47](http://developer.amazonwebservices.com/connect/entry.jspa?externalID=135&categoryID=47) and check this out, too: [http://townx.org/blog/elliot/s3\_rails](http://townx.org/blog/elliot/s3_rails) Hope this helps, Damien