Downloading files with download.php

Question

I need to deliver big files like file.zip (~2 GB) to customers, with a unique URL for each customer. Then I will redirect (with .htaccess) a customer download link example.com/download/f6zDaq/file.zip to something like

example.com/download.php?id=f6zDaq&file=file.zip

But as the files are big, I don't want the fact that PHP processes the downloading (instead of just letting Apache handle it) to be a CPU / RAM performance issue for my server. After all, asking PHP to do it involves a new layer, so it might cause such an issue, if not done properly.

Question: among the following solutions, which one(s) are the best practice? (in particular, in terms of CPU/RAM)?

• 1: PHP solution with application/download

  header('Content-Type: application/download');
  header('Content-Disposition: attachment; filename=file.zip');
  readfile("/path/to/file.zip");
  

  CPU usage measured while downloading: 13.6%.

• 1bis: PHP solution with application/octet-stream (coming from Example #1 of this page)

  header('Content-Description: File Transfer');
  header('Content-Type: application/octet-stream');
  header('Content-Disposition: attachment; filename=file.zip');
  header('Expires: 0');
  header('Cache-Control: must-revalidate');
  header('Pragma: public');
  header('Content-Length: ' . filesize('file.zip'));
  readfile("/path/to/file.zip");
  

• 1ter: PHP solution with application/octet-stream (coming from here):

  header('Content-Description: File Transfer');
  header('Content-Type: application/octet-stream');
  header('Content-Disposition: attachment; filename=file.zip'); 
  header('Content-Transfer-Encoding: binary'); // additional line
  header('Connection: Keep-Alive');
  header('Expires: 0');
  header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); // additional line
  header('Pragma: public');
  header('Content-Length: ' . filesize('file.zip'));
  readfile("/path/to/file.zip");
  

• 1quater: Another PHP variant with application/force-download (edited; coming from here):

  header("Content-Disposition: attachment; filename=file.zip");
  header("Content-Type: application/force-download");
  header("Content-Length: " . filesize($file));
  header("Connection: close");
  

• 2: Apache solution, no PHP involved: let Apache serve the file, and use .htaccess to provide different URL for the same file (many ways to do it can be written). In terms of performance, it's similar to let the customer download example.com/file.zip, served by Apache server.

• 3: Another PHP solution. This would probably work:

  $myfile = file_get_contents("file.zip");
  echo $myfile;
  

  but wouldn't this ask PHP to load the whole content in memory? (which would be bad in terms of performance!)

• 4: Just do a header("Location: /abcd/file.zip"); redirection as explained in File with a short URL downloaded with original filename.

  Problem with this solution: this discloses the actual location of the file

   example.com/abcd/file.zip
  

  to the end user (who can then use or share this URL without authentification) which is not wanted...

  But on the other hand, it is much lighter for the CPU since PHP just redirects the request and doesn't deliver the file itself.

  CPU usage measured while downloading: 10.6%.

---

Note: the readfile doc says:

readfile() will not present any memory issues, even when sending large files, on its own. If you encounter an out of memory error ensure that output buffering is off with ob_get_level().

but I wanted to be 100% sure that it won't be slower / more CPU/RAM hungry than pure Apache solution.

Answer 1

You could use .htaccess to redirect the request to the file while keeping the permalink structure:

RewriteEngine On
RewriteBase /
RewriteRule ^download\/([^\/]+)\/file.zip download.php?id=$1 [L,NC]

Then in your download.php, you can check if the provided id is valid:

// Path to file
$file = 'file.zip';

// If the ID is valid
if ($condition) {
    header("Content-Disposition: attachment; filename=\"" . basename($file) . "\"");
    header("Content-Type: application/force-download");
    header("Content-Length: " . filesize($file));
    header("Connection: close");
} else {
    // Handle invalid ids
    header('Location: /');
}

When the user visits a valid url http://example.com/download/f6zDaq/file.zip, the download will start and the connection will be closed.

If the user visits an invalid url, they will be redirected to the home page.

Answer 2

The biggest problems you're going to face with files of those sizes are the following:

• people downloading it with a download manager
• interrupted connections

Normally, keep-alive can be a bad idea, as it dedicates a connection to a download, which can bog down your network connections instead of allowing them to be freed up easily. However, if you're expecting all of your files to be large, this is your friend, because you don't want people re-starting those downloads. And those downloads will make reliable connections with keep-alive, and be easier for the client to resume which helps reduce people trying to re-download massive files.

As such, of your presented options, I recommend

1ter

However, as others on here, I still recommend you test your solutions, and preferably from a location separate than you're serving the files from.

Addendum: This said, serving with PHP isn't the best idea unless you have to get the header control features and .htaccess control in, because it's just adding more processing power. By far the better path would be simply to have the files in an accessible directory. .htaccess can rewrite access to files and folders, not just PHP scripts.

To create Apache-based protected download folders instead:

Options +FollowSymLinks
RewriteEngine On
RewriteRule ^/user/files/folder1.*$ http://example.com/userfiles/ [R=301,L]

Then, if you need to password-protect it, instead of using PHP, use Apache (which is already installed with most PHP installations). You do this by including a .htaccess file in the targeted folder (if you're dynamically making users, you might need to create a script to generate these for each new user) and making sure apache is prepped to handle passwords:

AuthType Basic
AuthName "Authentication Required"
AuthUserFile "/user/password/.htpasswd"
Require valid-user

(See here for more detail: Setting up Apache Passwords)

After this point, you make sure to have an .htpasswd file in the password directory with the format username:password/hashedpassword.

e.g.:

andreas:$apr1$dHjB0/..$mkTTbqwpK/0h/rz4ZeN8M0
john:$apr1$IHaD0/..$N9ne/Bqnh8.MyOtvKU56j1

Now, assuming you're not wanting them to pass in the password every single time, in the download link, include the access

<a href="user:pass@http://example.com/userfiles/myCoolZip.zip">Link (hopefully behind a password-protected interface.)</a> 

[Note: Do NOT use the direct password link method if passwords are not randomly assigned per file.]

OR if you're populating based off of the root apache password management AND your site is utilizing apache for it's login process, they might not need the user:pass part of the link at all, having already logged in with Apache.

NOTICE:

Now, this said, the files will be be accessible by people that the full link (with username/password) are shared with. So they'll be as secure (or as unsecure) as your server's https (or http if you allow) protocols, as well as your users sharing or not-sharing links.

Doing it this way, the files will be open to the users it's meant for with the full capabilities of the web accessible to them, meaning download helpers, browser-plugins that help, REST calls, and more, depending on your user's use cases. This can reduce security, which may or may not be a big deal depending on what you're hosting. If you're hosting private medical data (few users, high security, lower speed demands), I wouldn't do it this way. If you're hosting music albums, I'd totally do it this way (many users, lower security, high speed demands).

Answer 3

I would go with readfile. I used it for years, and never got memory issues, even running on a 128MB VPS.

Using PHP means you can easily handle authentication, authorization, logging, adding and removing users, expiring URL and so on. You can use .htaccess to do that, but you will have to write a rather large structure to handle this.

Answer 4

You can use X-Accel-Redirect when your webserver is Nginx. For Apache it's mod_xsendfile with X-Sendfile header.

<?php
header('X-Accel-Redirect: /download/f6zDaq/file.zip');

It costs less, also have a better performance, because web server handles file.