Restrict downloading files in Django?

[Robert Rössler]

Hello,

what is the best way to restrict downloading files only to authorized users?

I want to let users upload files and let them download them, but restrict downloading other users files.

Thank you

[Edgar Gabaldi]

i don't know if this is the best way to do that. But you can create a view that response the file after verify the user credentials. 

The problem is:  once the user knows the urls from file, he can share the url with others.

Its not difficult create an "one time url" to the request to solve this problem.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To post to this group, send email to django...@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/f67b7248-72e2-4ed9-95b6-66604598bc62%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Javier Guerra Giraldez]

On Sat, Jan 31, 2015 at 11:52 AM, Robert Rössler <r.ros...@gmail.com> wrote:
> what is the best way to restrict downloading files only to authorized users?

it's not hard to do if you manage the file downloading with a view.

of course, file serving within Django is very inefficient, your
webserver (Apache, nginx, etc.) is far more efficient at this.

so, the solution is to write a view that looks like it's serving the
file (after checking for authorization), but instead of actually
serving, delegates the job to the webserver. check X-Accel-Redirect
(nginx) or X-Sendfile (apache)

--
Javier

[Russell Keith-Magee]

The X-Sendfile (or analog) approach is the right way to go - there are even Django apps that can help manage this process. See:

http://www.paulpepper.com/blog/2014/02/django-x-sendfile-and-apache/

For a recent blog talking walking through the process.

Yours,

Russ Magee %-)