如何保护高流量网站的会员照片
在实际项目（约会网站）上，我有以下场景：
成员可以上传照片（主要个人资料）并创建相册并向其分配照片。现在会员可以选择只允许注册会员、高级会员或收藏夹会员访问该相册。
最简单的解决方案是隐藏相册，但如果有权访问的人将 src url 发布到照片，则每个拥有该 url 的人都可以访问该相册。
我看到 flickr 和 facebook 以一种很好的方式保护它们，但是我如何实现它而不需要多次查询数据库并复制用户身份验证/会话。照片将存储在自己的服务器（varnish/nginx）上。
有谁知道如何在高流量和使用尽可能少的资源的情况下做到这一点？
该解决方案需要能够处理实际的 2000 万会员和大约 3000 万张照片。
On a actual project (dating site) i have the following scenario:
Member can upload photos (main profile) and create albums and assign photos to it. Now the member can choose only to allow registered members, premium members or members in his favorites to access the album.
The easiest solution is to hide the album, but if someone who has access post the src url to the photo it would be accessible to everyone who has the url.
I see flickr and facebook secure them in a good way, but how i can implement that without to need to query many times the DB and replicate the user auth/session. The photos will be stored on a own server (varnish/nginx).
Has anyone a idea how this can be done in mind of high traffic and to use less resources as possible?
The solutions needs to can handle the actual 20m members and around 30m photos.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
好吧，一种可能是运行 Lighttpd 的
mod_secdownload。基本上，您在配置部分设置了一个“秘密”字符串。然后，当您生成链接时，它不是建立到资源的链接，而是一个临时链接（因此它仅在
$x秒内有效）。这样，用户需要再次访问该页面（并因此再次通过访问控制）才能查看该图像...Apache 有一个类似的模块：
mod_auth_token...Well, one possibility would be to run something like Lighttpd's
mod_secdownload.Basically you set a "secret" string in the configuration section. Then when you generate the links, instead of making a link to the resource, it's a temporal link (so it's only valid for
$xnumber of seconds). That way the user needs to visit the page again (and hence pass access control again) before being allowed to view that image...Apache has a similar module:
mod_auth_token...最好的解决方案是将图像存储在服务器的网络可访问部分之外。然后，您可以引用指向图像的 php 页面，而不是直接引用照片，如下所示：
http://www.example.com/image.php?imageid=1234567
然后在您的 php 脚本中，您可以检查登录用户是否有权访问该照片，如果可以，您将流式传输该照片在响应中将图像输出给用户。
The best solution is to store the image outside the web accessible part of your server. Then, instead of referencing the photo directly, you would reference a php page pointing to the image as so:
http://www.example.com/image.php?imageid=1234567
Then in your php script, you can check if the logged in user has access to the photo, and if so, you stream the image out to the user in the response.
作为一个想法......
您可以创建一个映射表，在其中根据收藏夹、朋友等为用户->照片对“准备”访问权限。
然后根据这些权限返回图像，但按用户缓存。这将减轻服务器的压力，但由于缓存超时，应用限制会出现一些延迟。
As an idea...
You could create a mapping table where you "prepare" the access permissions for pairs user->photo based on favorites, friends etc.
Then you return the images based on these permissions but cached per user. This will lower the stress on your servers but there will be some delay in applying restrictions due to cache timeouts.