Download the PHP package screamz/securedownload-bundle without Composer

SecureDownloadBundle

This bundle make it easier and quicker to deploy a secure download document solution, using a Cache engine like Memcached or Redis.

Many cache system are supported thanks to tedious/TedivmStashBundle!. At the moment the default one using service @stash, but feel free to override my service declaration to use your own.

Basic usage

In order to access a secured resource or file you need to pre-authorize this one.

You either need a file path on the system (full path) or some data you want to save. This can be whole base64 data, just some data that will be required to fetch some others data (like through a web-service).

In order to achieve that, you need to generate an access key that is known by the encoder and the decoder. This will allows you to secure the access to your resource or file, it can be a simple hash or string if the context doesn't depend on it or it can be a salt mixed with a unique identifier of the current logged used, you can also use a cookie to save it or a session variable. Feel free to try different approaches.

Here are quick example of common use case:

I have a path on my API, that I don't want to expose on the frontend

TransactionID generation

This path must be only accesible to the guy that triggered his generation too. If you share the download link to someone else this guy will not be able to download it.

For that we need something that identify in a unique manner the user who triggered the transactionID hash. The userID is perfect. If we wanted to allow sharing or the download link we could have used something that is not user-dependant.

Downloading the file using the given transactionID in a secured way

I want to save data that will allow me to query a remote API later in order to get something

Generate a transactionID

Retrieve the resource after checking authorization

Documentation

• Error codes
• Default configuration