Online Image Privacy without DataURI? (And possibly no IIS Security or htaccess)

Question

Here's my situation. A user logs in to an online app (JavaScript UI, PHP back-end) and requests a report. This report includes an image that should only be seen by the user, so it needs to be invisible to other users. Unfortunately, the various security methods I've looked into don't seem suited to my needs.

First, having the image just sitting in a folder would make it visible to other users. Randomizing the image name (assuming the user can't get a directory listing) is better, but it doesn't sit well with me. But maybe I'm just being paranoid...

Second, having the image outside of the web area and using a server side script to stream its content into a Data URI works great, but older versions of IE (on XP) cannot handle Data URIs > 32KB, and these images can be much larger than that.

Third, setting up user protection in folders via IIS/htaccess and putting the images there could work, but I've already set up security via a branded login page with row security. Re-structing my security is more disruption than I'd like, and I'd need to ensure I can brand the login.

Have I missed any options? Are any of the options above more viable than I gave them credit for?

Thanks in advance!

Answer 1

This is how would approach this problem (variation of your second idea).

create a dir called images outside of our document root.

In the document root, create a file called image.php which will act as a despatcher by first checking if user has permission and then load the image, else throw an error like this (example):

<?php

// Start PHP Session
session_start();

// Get Request Param
$image_file = isset($_GET['file_name']) ? basename($_GET['file_name']) : '';

// Check if current user has permission here, e.g. using Session?
if ($_SESSION['can_view_image'])
{
    // Check If The Image File Exists
    if (file_exists('../images/'. $image_file))
    {
        // Get File Ext
        $file_ext = trim(end(explode('.', $image_file)));

        // Set Content Type Header Based On File Ext
        switch ($file_ext)
        {
            case 'jpg':
            case 'jpeg':
                header('Content-Type: image/jpeg');
                break;

            case 'png':
                header('Content-Type: image/png');
                break;
        }

        // Load Image
        readfile($image_file);
    }
    else
    {
        // Error
        exit('Requested image file does not exists on this server.');
    }
}
else
{
    // Error
    exit('You do not have permission to view this image');
}

?>

Usage would look like this:

<img src="/image.php?file_name=some_important_chart.jpg" />

Users with the permission will see the image, user's without permission will see broken image.