On Mon, Apr 18, 2005 at 02:09:10 -0400,
brew@theMode.com wrote:
>
> Since I've heard large objects were a bother I've written it so the mp3s
> were in files with long obfuscated filenames and have put them in a
> directory hidden behind basic authentication, planning a php front end to
> the basic authentication and storing the file urls in the database. Now
> I'm considering shortlived symbolic filenames to further make it difficult
> to rip off the mp3 files by other users with valid log in credentials that
> can get past the basic authentication.
Why not put the files somewhere where only the application can get at them
instead of under the document root. That way they have to compromise your
application to get at them. No amount of url guessing will give direct
access.
