# Serving lots of images to only registred users

**URL:** <https://www.ruby-forum.com/t/serving-lots-of-images-to-only-registred-users/52049>\
**Category:** Rails\
**Created:** [January 10, 2006, 2:32pm UTC](https://www.ruby-forum.com/t/serving-lots-of-images-to-only-registred-users/52049 "2006-01-10T14:32:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sylow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e8c25b/32.png) [@sylow](https://www.ruby-forum.com/u/sylow)\
**Post date:** [January 10, 2006, 2:32pm UTC](https://www.ruby-forum.com/t/serving-lots-of-images-to-only-registred-users/52049/1 "2006-01-10T14:32:43Z")

</div>

Hello guys,

I am building a photo website and I have some questions before I really  
start programming the site.

My system will be Debian + lighttpd + mysql +fastcgi + ImageMagick

I plan to use file\_column for image handling/verification and thumbnail  
creation.

My question is;

I need to store images in a place outside of webroot so only registered  
members can see them. To serve them secure way I was planning to use  
send\_data to show pictures but

In thumbnails section I will be showing 20 images per page and lets  
assume their url will be

[domain.com/browse/image/111](http://domain.com/browse/image/111)

it means image action in browse controller will be called 20 times =  
lots of sql query to run especially for each image action I have to  
check if user is logged in user. It can be pretty heavy.

Anybody has better idea? Or anybody worked on such a project and what  
kind of solution you followed?

Thanks all

Regards  
Gokhan

---

<div class="post-metadata">

**Author:** ![sylow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e8c25b/32.png) [@sylow](https://www.ruby-forum.com/u/sylow)\
**Post date:** [January 10, 2006, 3:42pm UTC](https://www.ruby-forum.com/t/serving-lots-of-images-to-only-registred-users/52049/2 "2006-01-10T15:42:32Z")

</div>

You could use lighttpd mod\_secdownload[1], this way all authentication  
would only be done for the page itself and the page will decide  
if it will generate you working links for images. Ofcourse that means  
that the images have to be directly accessable from /public, but  
noone without access to the pages that show the images would be  
able to link to the images.

[1] [http://www.lighttpd.net/documentation/secdownload.html](http://www.lighttpd.net/documentation/secdownload.html)

---

<div class="post-metadata">

**Author:** ![sylow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e8c25b/32.png) [@sylow](https://www.ruby-forum.com/u/sylow)\
**Post date:** [January 10, 2006, 3:45pm UTC](https://www.ruby-forum.com/t/serving-lots-of-images-to-only-registred-users/52049/3 "2006-01-10T15:45:34Z")

</div>

what if you created a mapping in routes.rb for viewing images thru a  
controller, and then in the controller you put up top something along  
the lines of

before\_filter :login\_required to force a login for viewing any of those  
images ?

just an idea, i havent actually tested it.

adam

---

<div class="post-metadata">

**Author:** ![sylow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e8c25b/32.png) [@sylow](https://www.ruby-forum.com/u/sylow)\
**Post date:** [January 10, 2006, 10:03pm UTC](https://www.ruby-forum.com/t/serving-lots-of-images-to-only-registred-users/52049/4 "2006-01-10T22:03:08Z")

</div>

Tarmo =?ISO-8859-1?Q?T=E4nav?= wrote:

> You could use lighttpd mod\_secdownload[1], this way all authentication  
> would only be done for the page itself and the page will decide  
> if it will generate you working links for images. Ofcourse that means  
> that the images have to be directly accessable from /public, but  
> noone without access to the pages that show the images would be  
> able to link to the images.
> 
> [1] [http://www.lighttpd.net/documentation/secdownload.html](http://www.lighttpd.net/documentation/secdownload.html)

Hello Tarmo,

few weeks ago I looked at mod\_secdownload and now when I looked at  
again, it might be a good option to go for.

PS: Anybody using it with heavy load?

Thank you very much

Gokhan