php - Untraceable URL Mask -

i want mask file url on site can accessed, can't find direct url of file, if view html source code. don't know if possible php, please me. do.

if understand question correctly, want avoid "deep linking", i.e. extracting file url page , using elsewhere.

this can not directly done, information needed browser access file, , determined attacker quite able extract it.

there workaround though: make url dynamic.

• place file outside publically accessible web root
• when delivering html page php, create download token, has file path, expiry time (and maybe other factors such session id, referrer url, etc ...) cryptographically secured (i.e. hash server-known secret)
• deliver link download script, not file iself
• inside download script, verify parameters , hash, exit 304 (or maybe 404) if wrong
• if verification passes, deliver file

this protect deeplinking in attacker able extract url, loses validity after expiry time. if use ajax request create download token before starting download, can make quite short (few seconds)