文件上传：下载时的用户安全
我正在尝试在客户端和用户之间创建安全的文件传输，通过该传输我让客户端上传文件，然后单击他们希望与用户共享的文件。
当客户端将 url 传递给用户时，我的问题就出现了（该 url 存储在数据库中） 即：http://www.example.com/files/my- new-file.pdf
因此，用户单击该 URL 现在变得不安全，因为从技术上讲任何人都可以下载该文件。我如何才能使该文件只能由指定用户下载。
我希望这对我正在尝试做的事情有意义，并试图确保这些文件是安全的。任何想法将不胜感激。
I am trying to create a secure file transfers between a client and a user by which I have the client Upload files, and click on which ones they wish to share with the user.
My problem comes when the client passes a url to a user (This url is stored in the database)
ie: http://www.example.com/files/my-new-file.pdf
So then the user clicks on the URL and now becomes unsecure, because anyone technically could download this file. How do I make it so this file is ONLY able to be downloaded by the specified users.
I hope this makes some sense in what i'm trying to do and am trying to make sure these files are secure. Any thoughts would be appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您应该使用 PHP 页面来控制对资源的访问，而不是让 /files/ 目录直接通过 Web 服务器提供内容。
例如，一个简单的 PHP 页面可以从文件系统读取文件并提供该文件，以便将其下载到浏览器。
http://www.higherpass.com/php/Tutorials/File-Download-安全性/
您需要确保：
只能下载有效的文件
该请求来自允许访问所请求文件的有效的经过身份验证的用户
该 URL 中的简单示例很容易受到文件参数中目录遍历的攻击。您应该验证传递给 PHP 脚本的任何文件名，以防止“../..”类型的攻击。这实际上可能会变得相当复杂。
可能对您有用的是拥有一个令牌系统，其中文件由唯一的、复杂的、随机的令牌引用。数据库存储文件系统上的实际文件位置，当收到 /download.php?token=blah... 等请求时，您会查找 a) 由标记“blah”引用的文件的位置，以及 b)允许调用用户的会话访问该文件。如果一切顺利，则将文件提供给用户，否则将引发错误并记录非法访问。
You should use a PHP page to control access to the resources, rather than having the /files/ directory serve the content directly via the web server.
For example, a simple PHP page can read a file from the filesystem and serve this up so that it is downloaded to the browser.
http://www.higherpass.com/php/Tutorials/File-Download-Security/
You would want to ensure:
Only valid files can be downloaded
The request is from a valid authenticated user who is allowed to access the requested file
The simple example in that URL is vulnerable to directory traversal in the file parameter. You should validate any filename that is passed to your PHP script to protect against "../.." type attacks. This can actually get quite complex.
What may work for you is to have a token system where files are referenced by a unique, complex, random token. The database stores the actual file location on the filesystem, and when a request is recevied such as /download.php?token=blah... you lookup a) the location of the file referenced by token "blah", and b) that the session of the calling user is permitted to access the file. If all is well, serve the file to the user, otherwise raise an error and log the illegitimate access.
希望这对您有帮助。
Hope this help you.
我相信向注册用户添加安全首选项将使事情顺利进行。
您需要让用户登录才能上传文件。
否则，每当有人上传文件时，询问他/她的电子邮件地址并发送一个字符串密钥（由您的服务器随机生成并映射到上传的文件），想要下载的用户可能会使用该字符串密钥作为密码。
与上传者想要共享的用户共享该密钥...
I believe adding security preferences to the registered users will make the things work.
You need to have user logged in to upload the file.
Otherwise, whenever somebody uploads a file, ask his/her email address and send a string key (randomly generated by your server and mapped to the uploaded file) which may be used by the user who wants to download as password.
Share that key with the users who uploader wants to share...