note 88175 added to function.fread

Tom, the idea for the examples below is to ensure the user has proper credentials before serving the file. With that security in mind, the suggestion of a 302 redirection seems like a risky idea. Anyone with a modicum of networking experience can run a TCP trace and see the 302 Redirect response, as it is actually a response received by the client browser; the browser then makes a subsequent http request for the URL provided in the Location header. When that 302 response is captured by wireshark, the 'secret' location is then exposed and can be shared with anyone who wishes to bypass the authorization routines in the php. The only way to secure this would be for the 302 Redirection response to include some kind of unique, per-request, expiring authorization token, either on the end of the url or in a set-cookie, that is then checked by an authorization module implemented within the hosting webserver. Otherwise, you're relegated to the methods described below. ---- Server IP: 209.41.74.194 Probable Submitter: 98.218.222.193 ---- Manual Page -- http://www.php.net/manual/en/function.fread.php Edit -- https://master.php.net/note/edit/88175 Del: integrated -- https://master.php.net/note/delete/88175/integrated Del: useless -- https://master.php.net/note/delete/88175/useless Del: bad code -- https://master.php.net/note/delete/88175/bad+code Del: spam -- https://master.php.net/note/delete/88175/spam Del: non-english -- https://master.php.net/note/delete/88175/non-english Del: in docs -- https://master.php.net/note/delete/88175/in+docs Del: other reasons-- https://master.php.net/note/delete/88175 Reject -- https://master.php.net/note/reject/88175 Search -- https://master.php.net/manage/user-notes.php