Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

We have a site with a login area for customers to download documents that the client uploads for them. Got some 'sensitive' documents though that the client is forbidden from making available for download, but are allowed to display in the login area, provided the file can't be downloaded by the user.

Obviously as soon as the information is on screen there are ways of capturing it, but I think as long as there's no file > save (or right click > save as) kind of option possible then it's OK. Better still if the information couldn't even be copy / pasted. Any ideas how something like that could be achieved?

share|improve this question
5  
you do realize that in order to display anything to the user, the browser actually has to download it / a part of it in some sort or another of memory first, right? (also, you do realize that the client may or may not be a browser?) –  njzk2 Apr 10 at 12:58
    
What kind of documents? –  ZippyV Apr 10 at 12:58
    
also, a very annoying, ineficient, very late-90s solution is to prevent right click with javascript. It annoys the users, is totally useless in practice, but it may suite your client? –  njzk2 Apr 10 at 12:59
    
@njzk2 Yeah I realise that, hence the second paragraph :-) The right click disabling would be an effective enough (though annoying) solution except it wouldn't prevent file > save style saving. –  user37714 Apr 10 at 13:21
1  
You'll obviously need to render those documents server-side, because they're completely uncontrolled once the customer opens them in their preferred application. In fact, in almost all cases a browser downloads a document before handing it off to a viewer application, because the browser has no idea if the viewer is capable of retrieving that data from a URL. Take a plain .txt file. Notepad can't download it, so your webbrowser will (assuming it doesn't open them directly) –  MSalters Apr 10 at 15:13

3 Answers 3

If it's not too complicated, you could make a "screenshot" of it and post that on the page. They can save the image, but not the actual text/content.

Another small trick is placing a transparent div over it, disabling the right click for less tech advanced users.

You could also make a getMeTheFile.php and use that to get the files. In that PHP file, check if you are in the whole of the page, or opened directly (right click -> save would be a direct call).

I don't think you can stop this 100%, only throw up a few roadblocks.

share|improve this answer
    
Many thanks for the suggestions! If it was me uploading the files then I'd give these a try, but it's non-technical types who will be uploading the files, so I'm really looking for a solution that doesn't involve them having to do anything other than upload as normal. Aren't there some .htaccess tricks to force browsers to handle files in a certain way? Something like that is the kind of solution that would be ideal. –  user37714 Apr 10 at 10:29
2  
htaccess only does stuff on the server. the browser (or whatever client is used to access the page) cannot be compelled to any behavior. –  njzk2 Apr 10 at 13:00
    
You can screenshot serverside. I don't know how, and it's not easy, but it's not imposibble either –  Martijn Apr 10 at 13:30
    
@user37714 - From the uploader standpoint, there shouldn't be anything complicated anyways. Your server should just automatically be adding the "difficult to save off" stuff. You weren't planning on manually adding the relevant code to each file, were you? Obviously, you have to say "attempt to prevent save", but that should only be a Boolean flag. Note that the browser may save off a cached copy, despite your best efforts... –  Clockwork-Muse Apr 10 at 13:47

We have a site with a login area for customers to download documents that the client uploads for them. Got some 'sensitive' documents though that the client is forbidden from making available for download, but are allowed to display in the login area, provided the file can't be downloaded by the user.

Unfortunately, at least if we are to assume that by "file" you really mean "the uploaded content", this is an impossible combination.

It is impossible because, in order to display something that is on the Internet, the computer that is used to display it must first download that data to some sort of local media (even if only into RAM). If the browser can download the data, then a sufficiently motivated user can capture the downloaded stream and store it. 99% of the time it would probably be easier than that; web development debugging tools exist that would make such things relatively easy, even.

As has been pointed out, you can put roadblocks in place. Here are a few ideas:

  • Javascript to block right-clicking to bring up a context menu.

  • A Flash- or Java-based renderer that does not allow saving.

  • A transparent <DIV> element on top of the display element (but depending on specifics that may impact things like navigation within the document).

  • Check the HTTP Referer header server-side, and only send the data if it matches what you expect.

  • Use HTTPS, perhaps even with a client certificate, to help prevent stream sniffing.

  • Render to protected PDFs and only make those PDFs available.

In the end, though, these will be roadblocks. They cannot prevent downloading the content, precisely because the content must be downloaded in some form in order to be displayed. Here are some ideas how a user might be able to circumvent the above measures:

  • Javascript to block right-clicking to bring up a context menu. Disable Javascript client-side, or use some means of accomplishing the same thing that does not involve using the particular mouse button on the protected elements.

  • A Flash- or Java-based renderer that does not allow saving. Screenshots of the rendered content at an appropriate magnificantion, manually or automatically stiched together. Also downloaded data stream sniffing using e.g. a packet sniffer like Wireshark or tcpdump.

  • A transparent <DIV> element on top of the display element (but depending on specifics that may impact things like navigation within the document). Using a DOM-modifying extension like Adblock Plus or Firebug to remove or disable the offending element.

  • Check the HTTP Referer header server-side, and only send the data if it matches what you expect. Use a user agent that allows the referer to be set explicitly on an external request, such as Wget (also works with cookies etc.).

  • Use HTTPS, perhaps even with a client certificate, to help prevent stream sniffing. A traditional Man-in-the-Middle attack against the HTTPS stream.

  • Render to protected PDFs and only make those PDFs available. Use a third-party PDF viewer that does not honor the protection (there are several open-source PDF viewers available that could, if no such thing already exists, probably relatively easily by someone with appropriate knowledge, be adapted to ignore the protection flags).

In the end, you will have to discuss with your customer and find out exactly what their need actually is. Maybe one or a combination of the above will provide sufficient protection. But you'll have to tell them up front: it is not possible to prevent downloading while allowing display, because display implies downloading. Whether this is a problem is another matter that is dependent on the customer's risk analysis in the particular case.

share|improve this answer

If the documents are PDF files or can be converted to PDF files there are some options to restrict the use of the document like not being able to print, copy/paste or extract contents from it. You will probably need to buy an application from Adobe or Foxit to create those protected PDF's.

share|improve this answer
    
I agree here! Also look to automating the process. You can have an upload page that triggers a process that then converts the file and saves it to the public area as a protected document. –  closetnoc Apr 10 at 14:25
    
Since the problem is that "the client is forbidden from making [the documents] available for download", protected PDFs certainly won't help. –  Michael Kjörling Apr 10 at 14:47
1  
This is fake security because it depends on a "don't copy flag" which is honored by Acrobat Reader but not by all other PDF readers. Even with Reader, I just have to check [about:cache](about:cache) to find and copy it. –  MSalters Apr 10 at 15:15
    
@MichaelKjörling The customer still needs to be able to see it so the document has to be downloaded anyway. –  ZippyV Apr 10 at 15:29
    
@MSalters It's just as fake as all the other proposed solutions but in my opinion is the best of all evils: it doesn't depend on the browser and it works on all (portable) devices. –  ZippyV Apr 10 at 15:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.