# Secure Downloads

**URL:** <https://www.ruby-forum.com/t/secure-downloads/128212>\
**Category:** Rails\
**Created:** [February 5, 2008, 10:07pm UTC](https://www.ruby-forum.com/t/secure-downloads/128212 "2008-02-05T22:07:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdaoust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@mdaoust](https://www.ruby-forum.com/u/mdaoust)\
**Post date:** [February 5, 2008, 10:07pm UTC](https://www.ruby-forum.com/t/secure-downloads/128212/1 "2008-02-05T22:07:39Z")

</div>

I need to create a site which has downloadable files in a library. The  
site will be accessed via username/password login done in the Rails app.  
However, I need the actual downloadable files to be protected as well.

I’ll be running the rails app on a mongrel cluster.

I’ve looked at using lighttpd as the web/proxy server and the  
mod\_secdownload module which looks nice. However, I’d rather _not_ use  
lighttpd is possible.

Ideally, I’d like to use Apache or nginx as the web/proxy server but the  
lack a similar mod\_secdownload module.

Does anybody have any recommendation on how to achieve protected  
downloads without lighttpd or reverting to long random URLs (which is  
not that secure).

Thanks,

~ Mark

---

<div class="post-metadata">

**Author:** ![mdaoust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@mdaoust](https://www.ruby-forum.com/u/mdaoust)\
**Post date:** [February 6, 2008, 7:51pm UTC](https://www.ruby-forum.com/t/secure-downloads/128212/2 "2008-02-06T19:51:45Z")

</div>

You can use X-Sendfile with Apache to do this. The apache module is  
here: [tn123.ath.cx is offline](http://tn123.ath.cx/mod_xsendfile/)

There’s a plugin to handle the Rails side at  
[http://john.guen.in/rdoc/x\_send\_file/](http://john.guen.in/rdoc/x_send_file/)

With this approach, your Rails app handles the authentication, and  
then Apache sends the file when Rails has said it is ok to do so.

Michael S.  
[www.BuildingWebApps.com](http://www.BuildingWebApps.com)

On Feb 5, 1:07 pm, Mark D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![mdaoust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@mdaoust](https://www.ruby-forum.com/u/mdaoust)\
**Post date:** [February 10, 2008, 4:05am UTC](https://www.ruby-forum.com/t/secure-downloads/128212/3 "2008-02-10T04:05:32Z")

</div>

Many thanks Michael. I ended up using nginx’s ‘X-Accel-Redirect’ feature  
which is basically the same thing as Apache’s x-sendfile. Perfect!