How to Password protect files / sections on web page ?

Question

wonderland 0 Junior Poster

16 Years Ago

Hi,

I'm sorry in advance if this is the wrong section.

I wanted to know is it possible to password protect some files in web page ?
For example, If someone wants to download file, browsers requests password(one for all visitors), idea is that some files and/or sections of web site is accessible to those who know the password..

Any advice , help much appreciated ! :)

javascript security web-design

4 Contributors
16 Replies
1K Views
2 Days Discussion Span
Latest Post 16 Years Ago Latest Post by Alxandr

Dani AI

Generated 10 Months Ago

A short, practical summary and a safe option.

The JavaScript prompt shown by is only a UI convenience — it runs entirely in the visitor's browser, so the password or protected URL can be discovered (as warned). Directory-level protection with .htaccess (HTTP Basic Auth) is simple and secure for whole folders, but the browser itself shows the auth dialog and will display a 401 page if a user cancels; you cannot force a client-side redirect from that built-in dialog. For per-file control and a nicer flow (redirect on failure, custom login, logging, expiring links), follow 's second suggestion: keep the files outside the public webroot and serve them through a server-side script that enforces authentication.

Minimal PHP pattern (replace paths and auth check with your login/session system):

<?php
session_start();
if (empty($_SESSION['logged_in'])) { header('Location: /somepage.html'); exit; }

$file = basename($_GET['file']);
$path = '/home/you/protected_files/' . $file;
if (!is_file($path)) { header('HTTP/1.1 404 Not Found'); exit; }

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'. $file .'"');
header('Content-Length: ' . filesize($path));
readfile($path);
exit;
?>

Notes and tips: never embed plaintext passwords in pages; always validate filenames with basename() to prevent path traversal; use HTTPS; store credentials hashed and use session_regenerate_id() after login; set file permissions so the webserver user can read but files are not web-accessible; for very large files consider server features like X-Sendfile/X-Accel-Redirect to avoid blocking PHP. If you want the browser to show a custom error/redirect instead of the 401 dialog, do the check in a script (not .htaccess).

All 16 Replies

network18 15 Practically a Master Poster

16 Years Ago

try to code something like this -

function validate()
{
	var truePassword = 'test';
	var password = prompt('Enter the password','');
	alert(">>"+password+">>");
	
	if(password !='' && password !=null)
	{
		if(password != truePassword)
		{ 
			alert("You don't have download permissin for this");
		}
	}else
	{
		alert("Enter the password");
		
	}
}

network18 15 Practically a Master Poster

16 Years Ago

where in code should I put this php ?
is it for single file or for section in web page ?

Does it look like a PHP:'(
It may work against the single link which will prevent the download without entering the password

function validate()
{
	var truePassword = 'test';
	var password = prompt('Enter the password','');
	//alert(">>"+password+">>");
	
	if(password !='' && password !=null)
	{
		if(password != truePassword)
		{ 
			alert("You don't have download permissin for this");
			return false;
		}
	}else
	{
		alert("Enter the password");
		return false;
		
	}
}

It may still need some modification to it get working

Edited 16 Years Ago by network18 because: modified function

network18 15 Practically a Master Poster

16 Years Ago

whoops I'm sorry, don't know why I assumed that ..

if I have a .pdf file for example where should I put this code, or where in this code should I put this .pdf address ?

call this function on click of the link, from where you download the pdf file.

pritaeas 2,276 Most Valuable Poster

16 Years Ago

call this function on click of the link, from where you download the pdf file.

This would still allow for downloading without password, just by looking at the page source.

Another way would be to put the pdf in a separate folder on the server, and password protect it (using your cPanel, htaccess, or whatever you're using).

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

wonderland 0 Junior Poster · Answer 1 · 2009-11-04T16:25:44+00:00

where in code should I put this php ?

is it for single file or for section in web page ?

wonderland 0 Junior Poster · Answer 2 · 2009-11-04T16:39:39+00:00

whoops I'm sorry, don't know why I assumed that ..

if I have a .pdf file for example where should I put this code, or where in this code should I put this .pdf address ?

wonderland 0 Junior Poster · Answer 3 · 2009-11-04T17:03:19+00:00

Do I call function like this ?

<a href="faili/materiali/brosuras/maskesana.pdf" target="_blank" onclick="function name">

network18 15 Practically a Master Poster · Answer 4 · 2009-11-04T17:10:14+00:00

Do I call function like this ?

<a href="faili/materiali/brosuras/maskesana.pdf" target="_blank" onclick="function name">

yes, its doesn't seem to be fullproof, even if after some modification to it

wonderland 0 Junior Poster · Answer 5 · 2009-11-04T17:24:03+00:00

It doesn't seem to work:

I wrapped code you provided in js tags (otherwise code showed as plain text on page)

Edited link like this <a href="faili/materiali/brosuras/maskesana.pdf" target="_blank" onclick="function validate">

pritaeas 2,276 Most Valuable Poster Moderator Featured Poster · Answer 6 · 2009-11-04T17:50:16+00:00

<a href="faili/materiali/brosuras/maskesana.pdf" target="_blank" onclick="validate();">

network18 15 Practically a Master Poster · Answer 7 · 2009-11-04T17:57:48+00:00

Leave it, it wont work.Here is one more logic -
-redirect the user to another php page when he tries to download the pdf, adn check his username/password there.
-if username/password are right just get him back to the previous page or else directly exit or do whatever you wish.

Alxandr 5 Junior Poster in Training · Answer 8 · 2009-11-05T05:05:27+00:00

There are 2 ways to securely do this. The first one is to make the download dir inaccessible without password (this is as said done in htaccess e.l. and not in you code). The other one is to put the file outside of you public_html-folder (http_root o.l. it might be called on a winserver) and use a script/program like php or C# to read the file and output it to the response-stream if the password is correct.

wonderland 0 Junior Poster · Answer 9 · 2009-11-05T05:18:58+00:00

I found out about htaccess few hours ago. Now I know how can I password protect a single html page. which was one of the things I needed.

But how can I password protect single file or better yet <a href> tag ? I don't know much about php etc. so I wanted to ask in this forum for some help, maybe someone know some tutorials regarding this .. :)

Alxandr 5 Junior Poster in Training · Answer 10 · 2009-11-05T05:30:13+00:00

I found out about htaccess few hours ago. Now I know how can I password protect a single html page. which was one of the things I needed.
But how can I password protect single file or better yet <a href> tag ? I don't know much about php etc. so I wanted to ask in this forum for some help, maybe someone know some tutorials regarding this .. :)

Password-protecting a single a-href doesn't make sense. What does is to password-protect the file that the a-href points to. And if you already know how to password-protect a html-file my guess is that it shouldn't be much of a difference in password-protecting a pdf-file or a img-file etc.

wonderland 0 Junior Poster · Answer 11 · 2009-11-05T05:47:24+00:00

Thanks, everything works great, I don't know why, but somehow I imagined this would be much harder :p.

Got 1 question though:

when I clicked on .pdf link (without .htaccess) it opened in a new tab/window. Now when I have .htaccess, browser opens new tab and asks for authorization , which is all great, but if i press cancel I get Authorization Required error page. Is it possible to somehow get redirected back to the page from which I opened that .pdf instead of error page ?

Alxandr 5 Junior Poster in Training · Answer 12 · 2009-11-05T07:05:55+00:00

I'm not shure about that. That's about server-settings, and not programming (.htaccess is too actually server-settings, but I'm not that familiar with it).

How to Password protect files / sections on web page ?

Dani AI

Recommended Answers Collapse Answers

All 16 Replies

Recommended Answers