PayPal and Protect Download

[hermes980]

Hi all,

I would like to setup a page where a customer can download a file they buy
using PayPal. But, I want this page to be protected from them going back,
sending the link to my download page to others, etc. I suppose I can give them
a username and password, but then how do I make it where if they login they can
only login once to download the file?

Also, is there a simple way to just hide the download pages link information
or make a temporary link? What have others done to accomplish protecting their
downloadable products?

Thanks in advance!

[Stressed_Simon]

Hold the files in a folder outside of your webroot and use cfcontent to deliver them the content with some provisos, ie logged in, certain IP. Anything you like!

[hermes980]

Ah,

So if I used this code:
How would I retrieve .zip files?

<cfif fileexists("#secureroot#\#filename#")>
<cfheader name="Content-Disposition" value="filename=somefilename">
<cfcontent file="#secureroot#\#filename#" deletefile="No" type="#mimetype#">
<cfelse>
<cfoutput>ERROR: Could not find - #filename# </cfoutput>
</cfif>

[shawnwindler]

If you decide to go the username/password route, I'd think it would be pretty
simple to allow them to enter only once.

Generate a random username/password combination.
Store the username/password in a database
Give this combination to the user.
When they login and download the file, mark that they have logged
in/downloaded the file in the database for that username/password.
Then don't allow that username/password combination to log in again (based on
the field for logged in/downloaded).

- If they don't successfully download the file, they may be locked out from
trying again though.
- What is to prevent them from simply sending the file (that they downloaded)
to a friend?

Hope that helps.

- Shawn

[hermes980]

To illustrate it further I am planning the following:

1) description of item with paypal button with a link to a
2) .cfm page that has a cflocation tag that sends the user to a
3) cfcontent page with the file outside the webroot

Would this sufficiently prevent the user from coming back using the link to
the .cfm page with the cflocation tag to download the file? OR is step 2
unecessary since the paypal button link would send them to the cflocation tag
and so forth....

I guess the key to protecting it is the cfcontent page.

[hermes980]

Shawn,

You are right. I guess if they just copy the file they can send it along. Then I guess cfcontent is my best chance of preventing basic hacking...

What do most people do in my situation?