@ctietze I wrote about some of the options and their relative costs a long, long time ago: https://www.garfieldtech.com/blog/readfile-memory (It's on a very old version of PHP, but I don't think the basic feature has changed in 20 years.)
Basically, authenticate and then use readfile(). You'll be fine. Or authenticate and then use XSendfile (Apache), or equivalent (nginx).
Symfony as a response object that does this for you, as do good PSR-7 implementations.
@Crell thank you, this analysis is great! I'm putting the gist of these findings into my Zettelkasten for reference. Haven't thought about memory mapping here at all!
@ctietze not sure about Apache, but if switching to Nginx is an option, it supports auth subrequests. I don't know if there's a way to do it with Apache.
Another very useful alternative is using a separate CDN to serve the files with token authorisation - you add some parameters to the URL, and it will check and allow/deny the DL.
I had good results with both Google-Cloud-storage and BunnyCDN doing that.
@ctietze It would depend what the files are - if there were pre-created and you might want to download them again (or you otherwise want to store them long term), then pre-creating and uploading the files to the CDN is a great solution.
If they are dynamically created one-offs, then a local XSendFile solution is probably better - or just taking the hit with sending them to the user with https://www.php.net/manual/en/function.readfile.php
@ctietze If the PDFs are in S3, you could have your PHP generate a signed URL and redirect the user to it, which will authenticate them directly with AWS to get the file.
@ghorwood@jamesholden That's really cool, thanks you two. We only read-protect 2 workshop slide decks at the moment, so a CDN isn't needed, but I can see where this would come in handy for our forums!
@ctietze php can be quite efficient in terms of execution and memory to serve a static file after an autorisation check.
Symfony http component have a static file response that does that very efficiently.
Not sure for apache autorisation and redirection but I'm fairly sure it might be possible as well.
@deanatoire@ctietze Yeah, if the implementation just uses readfile(), or fopen() with fpassthru(), or similar I wouldn't worry much unless you've clearly identified performance right there specifically as a problem.
There are probably some shenanigans that could be pulled with HTTP authentication, but I probably wouldn't.
@ctietze@deanatoire@Crell Nice. Yeah, I've got a few sites I run that while admittedly not very high traffic, do involve routinely serving hundreds of megabytes at a time through readfile() (same deal, big PDFs that need access control) and it's been totally fine even on a pretty modest server.
@ctietze@joby@deanatoire Pretty sure yes. If you wanted to do that, there's some complex and rarely used HTTP headers that you'd have to handle manually, then work on the streams yourself. That would definitely be slower, but assuming my benchmarks are still vaguely correct, it wouldn't be orders of magnitude slower.
Unless that's a common issue for your use case, it's probably not worth the trouble.
Add comment