在管理员删除访问权限之前授予对图像的有限访问权限？
我希望人们能够在有限的时间内访问图像。 例如，他们支付 x.jpg 并且可以访问它，直到我决定他们 不再有权限下载它。
注意：存储 x.jpg 的“images”服务器独立于“www”服务器，因此系统 可以轻松扩展。 （两台服务器不共享数据、数据库访问等...）
到目前为止我发现的最佳解决方案是：
在 www 服务器上，我生成一个包含两个参数的加密字符串： “文件名”和“expiration_stmp”。我将此加密字符串传递给图像服务器上的脚本 解密它，检查过期stmp是否不是过去的，如果一切正常， 读取磁盘上的文件，输出正确的标头，并将图像二进制数据输出到客户端。
所以我在 www 服务器上有一个像这样的链接：“img src=http://IMAGES.myserver.com/get.php?XJDKUJHKDJSHJKDHJKHJKDJKDJKD” 其中“XJDKUJHKDJSHJKDHJKHJKDJKDJKD”解密后将提取到 filename=x.jpg,expiration_stmp=132920302030 图像服务器上的 get.php 将包含类似 header('Content-type...blablabbl'); 的内容readfile(x.jpg).....
我要解决的问题是在我生成加密字符串XJDKUJHKDJSHJKDHJKHJKDJKDJKD时， 我无法知道expiration_stmp，因为管理员可以在未来随时（从1分钟到5天）删除访问权限。 因此，当管理面板中的管理员删除该特定用户读取文件的权限时，必须拒绝该用户的访问 到文件。
为了解决这个问题，我考虑通过强制刷新页面来每小时重新生成包含链接的页面，以生成新的加密字符串，其中包含新的expiration_stmps，其有效期最长为1小时。所以链接“img src=http://images.myserver.com/get.php?XJDKUJHKDJSHJKDHJKHJKDJKDJKD”的有效期只有1小时，所以当管理员取消用户的访问权限时，我只是拒绝重新生成新的加密的字符串，以便用户在最后生成的expiration_stmp过期（最多1小时）后无法再访问该文件。
目前这是我找到的最好的解决方案......我很想听听任何想法或更好的方法来处理这种情况？
谢谢
I want people to have access to images for a limited amount of time.
Example they pay for x.jpg and they have access to it until I decide they
no more have access to download it.
note: The 'images' server that store x.jpg is independant from the 'www' server so the system
can scale easily. (The two servers don't share data, db access or so...)
The best solution I found so far is this one:
On the www server, I generate an encrypted string that contains two parameters:
"filename" and "expiration_stmp". I pass this encrypted string to a script on the image server
that decrypts it, check if the expiration stmp is not in the past and if everything is ok,
read the file on disk, output the correct headers and output the image binary data to the client.
So I have a link like this one on www server: "img src=http://IMAGES.myserver.com/get.php?XJDKUJHKDJSHJKDHJKHJKDJKDJKD"
where the "XJDKUJHKDJSHJKDHJKHJKDJKDJKD" when decrypted will extract to filename=x.jpg,expiration_stmp=132920302030
and get.php on images server will contains something like header('Content-type...bblablabl'); readfile(x.jpg).....
The problem I have to solve is the fact that at the time I generate the encrypted string XJDKUJHKDJSHJKDHJKHJKDJKDJKD,
I cannot know the expiration_stmp because the access right can be removed by an admin anytime by in the future, from 1 minute to 5 days.
So when an admin in the admin panel remove the right to read the file for that particular user, the user must be denied access
to the file.
To handle that, I thought of regenerating the page that contains the links every hour by a forced refresh of the page to generate new encrypted string that contains new expiration_stmps that are valid for 1 hour maximum. So the links "img src=http://images.myserver.com/get.php?XJDKUJHKDJSHJKDHJKHJKDJKDJKD" would be valid only for 1 hour, So when an admin cancels the access right of a user, I just refuse to regenerate a new encrypted string so the user can no more access the file after the last generated expiration_stmp has expired (1 hour max).
For now it is the best solution I found....I would love to hear any thoughts or better way to handle such a situation?
thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
为什么您认为按用户或会话进行限制无法扩展。您可能可以生成访问代码而不是加密字符串。将访问代码以及用户 ID 存储在链接到您应该提供服务的图像的数据库中。如果管理员想要删除访问权限，只需删除该记录，或将其标记为已过期。数据库速度非常快，具有适当索引的数据库没有理由不能处理这个问题，即使扩展到数百万个活动图像。
Why are you under the impression that restricting by user or session won't scale. You could probably generate an access code instead of your encrypred string. Stor the access code in the DB linked to the image you are supposed to serve, as well as th user id. If the admin wants to remove access just delete the record, or flag it as expired. Databases are very quick and there is no reason a database with proper indexes shouldn't be able to handle this, even of scaled up to millions of active images.
最好的解决方案是在以下结构中使用数据库：
token ： token 将有一个 userID 字段，该字段将指向另一个存储用户信息的表，一个图像 ID（将引用图像数据库中的图像），以及一个到期日期和一个 ID。
image ：它将包含
下载链接的 ID、imagename，您可以简单地执行以下操作：download.php?tokenID=xxx，脚本将检查到期日期是否在过去，这将在以下情况下实时发生：用户单击该文件，这样您就不会遇到未经授权的访问问题。检查过期后，您可以从令牌字段获取 imageID 并在其他服务器上找到该图像。
您可以通过拥有一个或多个数据库服务器（我认为一个应该足够）来轻松扩展此结构，并将所有文件/脚本服务器连接到远程数据库服务器。
如果没有数据库，则不可能考虑到该文件只能从 GET 变量中获取日期，并且无法通过任何引用对其进行检查，并且如果您使用任何常见的 php 函数来加密变量，则系统应该很容易被破解。
The best solution would be using a database in the following structor :
token : token will have a field for userID which will point to another table to store user's info , an image ID which will refer to an image in the image database, and an expiry date and an ID.
image : it will have ID, imagename
for the download link, you could simply do : download.php?tokenID=xxx and the script would go and check if the expiry date is in the past or not, this will happen in real time when the user clicks on the file so you wont have the problem of unauthorized access. once the expiry is checked you can get the imageID from the token field and find the image on the other server.
You can easily scale this structure by having one or more database servers (one should be enough in my opinion) and connect all the file/script servers to the remote database server.
without having a database it would be impossible considering that the file will only get the date from the GET vars and cant check it with any reference, and the system should be easily hackable if you use any common php functions to encrypt the vars.