PHP - How to block files access in specific directory from the external

Question

I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach a file in PDF format. My dashboard is in a directory like /var/www/my-dashboard and inside there is another directory with all the PDF file uploded by the users: /var/www/my-dashboard/files with a structure like this: /var/www/my-dashboard/files/file1.pdf /var/www/my-dashboard/files/file2.pdf /var/www/my-dashboard/files/file3.pdf

The users have to login to the dashboard to insert an activity and upload the PDF file so a non-registered user can't do this. The problem is that a non-registered user with a specific link can access the PDF files from the internet (with a link like this: http://[IP/DNS]/files/file1.pdf). I want to avoid this that these files can only be opened and viewed by the registered user. How can I implement this in PHP?

Answer 1

You can use PHP to display the PDFs.

Make sure to store your PDF files in a folder, which is not accessible via a direct HTTP request.

Example: Put it into /var/www/pdfs/ and reach the directory via PHP or block access to your specific folder in your Nginx or Apache2 configuration.

$file = 'file1.pdf';
  
header('Content-type: application/pdf');
header('Content-Disposition: inline; filename="' . $file . '"');
header('Content-Transfer-Encoding: binary');
header('Accept-Ranges: bytes');
  
@readfile($file);