3

I'm building a website for public use.

It's a sharing website - everyone is allowed to download specific content, but I want to make sure nobody knows where all the files are kept, so I've decided to use URL Forwarding, e.g. when someone visits fakesite.com, it returns realsite.com without revealing/redirecting to realsite.com.

I don't know how to make this work. Please help me by explaining how to use URL Forwarding.

2

It sounds to me like your problem is user permissions. It doesn't matter if a user knows where a "file is kept" as long as they can't download it when they shouldn't.

What you need to do is first store the files outside of the web root - for example if your site root is in /var/www/website, store the files in /var/websitefiles.

Then on the site link to something like example.com/download.php?file=123 which runs a script/program that gets the file from that websitefiles folder and serves it to the user.

The download script can then check user permissions and deny the visitor access if they shouldn't have it.

1
  • Nice! This will definitely come in handy :) – Nick Jul 11 '12 at 19:30
1

You can't get there with forwarding, as forwarding will, by definition eventually take customers directly to the final location. What you need is reverse proxying.

A reverse proxy works by going to a an address, and having that address proxy the request to a different address at the final site. This does, of-course, mean a double-up of bandwidth use - Once from the client to the proxy, and once from the proxy to the actual server. The flipside of this is you can swap out the proxy for a CDN and have a distributed frontend.

You can build a reverse proxy yourself (lots of ways to do it, Apache has a module to do it, and I believe Nginx and Squid do as well. Its also practical to roll your own if you limit the scope). That said, for the general case most entities use services like Cloudflare or Cloudfront. This has an added advantage of adding DoS protection and other management tools.

Word of caution - if you are planning on distributing content of questionable legality - asking the question you did exposes a lack of knowledge required to avoid getting caught - so don't do it. While this will be strong protection against end users, it will not by itself prevent agencies backed by government from tracking back to the final site, as there is a lot of infrastructure required of ISPs to help governments/spy agencies - and this is likely to expose the ultimate location if a government deems it worthwhile.

0

Generally, we use proxies (reverse proxies) for this, or we just make the server listen on two domain names. If you don't own the domain you're linking to, you probably aren't allowed to proxy their site through your domain. This sounds to me like a warez or similar site, with which I want nothing to do with.

If you really want to go ahead with the reverse proxy, see another answer of mine: Point sub directory to another IP?

Just instead of using the IP, use your other domain name, and rather than make an Alias to a subfolder, make the entire VirtualHost listen for your public domain.

1
  • It's not warez, that's for sure! – Nick Jul 10 '12 at 14:55
0

Most servers will allow you to restrict access to the folder itself as not to show all the files inside of the directory. You could throw up an index.html which would prevent it too and then encrypt the name of the file (like vWorker does). That way even if someone knows all the files, they still can't get to them.

If you just want to hide the domain name you could use a CNAME in your DNS and point it to the other domain. If you don't have control over this Amazon Route53 makes it real easy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.