Re: Securing PDF file on a Website

[focus () karsites net]

If you just want to limit access on a once-per-user basis, 
by their email address, you could try the following.

Generate a unique session ID for that particular user, when 
they request access to the pdf file, on your website.

Save that session ID in a database table for user 
authentication.

Email a link to the user, with the session ID in the URL.

When the user clicks on the URL you emailed to them, for 
access to the particular file, check the session ID in the 
URL with the session ID in the authorisation database.

If the session ID exists in the database, allow access to 
the file. Keep some other columns in the table for admin 
purposes. Eg. some sort of time limits, or access limits.

When the user has accessed the file, delete the record with 
the session ID from the database.

If the user tries to access the file, after a certain time 
constraint, or number of accesses has been reached, then 
they will be prohibited from accessing it.

Or, just generate a unique password for accessing the pdf 
file, and email that to all users. Change the password as 
often as required, eg. weekly, fortnightly.

Store the generated password in a database for login 
authorisation.

Check the password supplied by the user, with the stored 
password in the database, to see if they are matching.
If they do, allow access to the file.

HTH - Keith Roberts

http://www.karsites.net/

SPDTool - an idea for a structured open source development
CASE tool. Find out more at the above link!


On Sat, 23 Jul 2005 echow () videotron ca wrote:

> To: webappsec () securityfocus com
> From: echow () videotron ca
> Subject: Securing PDF file on a Website
>
> To all:
>
> Is there a way that I can add access to a pdf file to a 
> website in a secure way? What I was thinking was to 
> require user name and password to access this very 
> confidential file. I was also thinking about requiring the 
> use of tokens and/or certificates.
>
> The user group for this application is pretty low tech so 
> my challenge is to come up with something that is secure 
> but really straightforward to use.
>
> Any thoughts on how I would implement this would be most 
> appreciated.
>
> Regards,
>
>
>
> Edmond