Restricting access to images on a website

Question

I'm putting together a portfolio website which includes a number of images, some of which I don't want to be viewable by the general public. I imagine that I'll email someone a user name and password, with which they can "log-in" to view my work.

I've seen various solutions to the "hide-an-image" problem on line including the following, which uses php's readfile. I've also seen another that uses .htaccess.

Use php's readfile() or redirect to display a image file?

I'm not crazy about the readfile solution, as it seems slow to load the images, and I'd like to be able to use Cabel Sasser's FancyZoom, which needs unfettered access to the image, (his library wants a link to the full sized image), so that rules out .htaccess.

To recap what I'm trying to do:

1) Provide a site where I give users the ability to authenticate themselves as someone I'd like looking at my images. 2) Restrict random web users from being able see those images. 3) Use FancyZoom to blow up thumbnails.

I don't care what technology this ends up using -- Javascript, PHP, etc. -- whatever's cleanest and easiest.

By the way, I'm a Java Developer, not a web developer, so I'm probably not thinking about the problem correctly.

Answer 1

Instead of providing a link to an image. Provide a link to a cgi script which will automatically provide the proper header and content of the image.

For example: image.php?sample.jpg

You can then make sure they are already authenticated (e.g. pass a session id) as part of the link.

This would be part of the header, and then your image data can follow.

header('Content-Type: image/jpeg');

Edit: If it has to be fast, you can write this in C/C++ instead of php.

Answer 2

Using .htaccess should be the safest/simplest method, as it's built in functionality of the webserver itself.

Answer 3

I do not know if it fits your needs, but I solved a similar poblem(giving pictures to a restricted group of people) by using TinyWebGallery, which is a small gallery application without database.

You can allow access to different directories via password and you can upload pictures directly into the filesystem, as TinyWebGallery will check for new dirs/pics on the fly. It will generate thumbnails and gives users possibility to rate / comment pictures (You can disable this).

This is not the smallest tool, however I thik it is far easier to setup than using apache directives and it looks better as naked images.

Answer 4

If you're using Nginx, you could use the Secure Link module.