Laravel authenticated file download

Lets say I want to make an application where users can upload private files to a laravel based website. I dont want to make their files available to public, but I want them to be able to download the files after they have logged in. So I need to verify that they have logged in, and that they have the correct account ID to download a specific file.

How can I create this restriction? Assuming laravels Response::download method bypasses. Edit I guess I will just store the files in the database as blob, and load it from there.

That way I can easily do authorisation validation. All you have to do is just store files in a private directory eg. I just came across this and maybe it can help someone too. I used this to "protect" my PDF documents to only logged in users. The Controller was protected by the 'auth' middleware in the constructor. Where Publication stored the hash reference to the file. This way there was no way for the user to "see" where the actual file was.

The "no caching" headers made sure the browser didn't cache the PDF. Follow the below steps and easily download files from public stroage folder. And as well as display files on laravel blade views:. First of all, you need to add the following routes on web. So navigate to routes folder and open web.

Then update the following methods as follow:. The above code will download files from public storage by giving the file name and return a response with correct content type.

Store pdf files at secure location. View protected pdf for Registered User. Here is the solution you can follow — Create a pagination which includes one item per page for pdf files.

Next whatever buttons you want add you can add those on top of iframe. I have like 30 PDF documents, that means I will have to create 30 views? Or how does it work? Close dialog. You may use the once method to authenticate a user with the application for a single request.

No sessions or cookies will be utilized when calling this method:. HTTP Basic Authentication provides a quick way to authenticate users of your application without setting up a dedicated "login" page. To get started, attach the auth. The auth. Once the middleware has been attached to the route, you will automatically be prompted for credentials when accessing the route in your browser.

By default, the auth. To correct these problems, the following lines may be added to your application's. To accomplish this, define a middleware that calls the onceBasic method. If no response is returned by the onceBasic method, the request may be passed further into the application:.

Next, register the route middleware and attach it to a route:. To manually log users out of your application, you may use the logout method provided by the Auth facade. This will remove the authentication information from the user's session so that subsequent requests are not authenticated. In addition to calling the logout method, it is recommended that you invalidate the user's session and regenerate their CSRF token.

After logging the user out, you would typically redirect the user to the root of your application:. Laravel also provides a mechanism for invalidating and "logging out" a user's sessions that are active on other devices without invalidating the session on their current device.

This feature is typically utilized when a user is changing or updating their password and you would like to invalidate sessions on other devices while keeping the current device authenticated. Then, you may use the logoutOtherDevices method provided by the Auth facade.

This method requires the user to confirm their current password, which your application should accept through an input form:. When the logoutOtherDevices method is invoked, the user's other sessions will be invalidated entirely, meaning they will be "logged out" of all guards they were previously authenticated by. While building your application, you may occasionally have actions that should require the user to confirm their password before the action is performed or before the user is redirected to a sensitive area of the application.

Laravel includes built-in middleware to make this process a breeze. Implementing this feature will require you to define two routes: one route to display a view asking the user to confirm their password and another route to confirm that the password is valid and redirect the user to their intended destination. After confirming their password, a user will not be asked to confirm their password again for three hours. First, we will define a route to display a view that requests the user to confirm their password:.

As you might expect, the view that is returned by this route should have a form containing a password field. In addition, feel free to include text within the view that explains that the user is entering a protected area of the application and must confirm their password.

Next, we will define a route that will handle the form request from the "confirm password" view. This route will be responsible for validating the password and redirecting the user to their intended destination:. Before moving on, let's examine this route in more detail. First, the request's password field is determined to actually match the authenticated user's password.

If the password is valid, we need to inform Laravel's session that the user has confirmed their password. The passwordConfirmed method will set a timestamp in the user's session that Laravel can use to determine when the user last confirmed their password.

Finally, we can redirect the user to their intended destination. You should ensure that any route that performs an action which requires recent password confirmation is assigned the password.

This middleware is included with the default installation of Laravel and will automatically store the user's intended destination in the session so that the user may be redirected to that location after confirming their password. After storing the user's intended destination in the session, the middleware will redirect the user to the password. You may define your own authentication guards using the extend method on the Auth facade.

You should place your call to the extend method within a service provider. Since Laravel already ships with an AuthServiceProvider , we can place the code in that provider:. This interface contains a few methods you will need to implement to define a custom guard. Once your custom guard has been defined, you may reference the guard in the guards configuration of your auth.

The simplest way to implement a custom, HTTP request based authentication system is by using the Auth::viaRequest method. This method allows you to quickly define your authentication process using a single closure. The viaRequest method accepts an authentication driver name as its first argument.

This name can be any string that describes your custom guard. The second argument passed to the method should be a closure that receives the incoming HTTP request and returns a user instance or, if authentication fails, null :. Once your custom authentication driver has been defined, you may configure it as a driver within the guards configuration of your auth. If you are not using a traditional relational database to store your users, you will need to extend Laravel with your own authentication user provider.

We will use the provider method on the Auth facade to define a custom user provider. After you have registered the provider using the provider method, you may switch to the new user provider in your auth.

First, define a provider that uses your new driver:.