I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ?

We have customers invoice files stored in a server location (publicly inaccessible location), then we do read them via the PHP code in a file (in public accessible location) like below,

I just wonder, if this way of

  1. presenting files to the enduser is secure enough ?
  2. that end user will not have any knowledge at all, of where the files are stored in the server ?
  3. any other recommendation on how to handle similar situation ?

    $i = $invoice->get();
    $filename = sprintf(INV_PDF_FILENAME,$i['customerid'],date('Ymd',$i['dateIssued']));
    $x = sprintf('/tmp/invoices/%s',$filename);
    header('Content-type: application/pdf');
    header('Content-Disposition: attachment; filename="'.$filename.'"');
    header('Expires: 0');
    header('Pragma: cache');
    header('Cache-Control: private');

1 Answer 1


All the end user will see is that it's a PDF and the filename. Assuming you're also doing work to ensure the current user is allowed to download the PDF, this is fine. If anything, I'd be more concerned with what information is stored in the PDF itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.