I have some files that I want to be accessible only to registered users. So I have uploded them to a page set as private. Is this sufficient to prevent unregistered users to download them? I have made a simple test and it seems to me that the answer is: yes, it suffices, but maybe I forget something...
1 Answer
If people can guess the file download urls then they will still be able to get to them (e.g. if someone who has access shares the download urls out).
To get around that kind of problem you typically need to set up a file handler script that will grab them from a protected directory that prohibits direct content downloading and serve them up.
That being said, what you are doing is generally good enough unless it is vitally important that people not be able to find and download things.
-
The test I've made is the following. I've copied the url to the document, and pasted it into the address bar of another browser window where I was not authenticated. And I received the message: Something is going wrong. Bad address, or perhaps you try to access to a private document. So, I suppose that guessing the file download url can't help to circumvent the protection...– TocFeb 19, 2015 at 20:09
-