<p>There is now the <a href="https://github.com/tikiatua/internal-assets-plugin" rel="nofollow">Internal Assets Plugin</a> which allows to place assets above the web root and works as expected.</p>

CC BY-SA 3.0
2014-10-03T18:51:58.770Z
2014-10-03T18:51:58.770Z
Lars Bilke
<p>I ran into this requirement today and initially assumed a plugin would be required, but then I spotted that the native Assets action menu already included a Download File option and it was working just fine with files that weren’t publicly accessible. Maybe we could use that rather than reinventing the wheel?</p>

<p>If you check DownloadFileElementAction.php you can see the markup and JS that’s used for this button in the control panel. It generates a simple <code>&lt;form&gt;</code> tag that POSTs to <code>assets/downloadAsset</code>. With a tiny bit of tweaking that can be converted to a code suitable for use in a frontend template:</p>

<pre class="lang-html prettyprint-override"><code>&lt;form method="post" target="_blank" action=""&gt;
    {{ getCsrfInput() }}
    &lt;input type="hidden" name="action" value="assets/downloadAsset" /&gt;
    &lt;input type="hidden" name="assetId" value="123" /&gt;
    &lt;input type="submit" value="Submit" /&gt;
&lt;/form&gt;
</code></pre>

<p>This works a treat and includes all native permissions checks as you’d expect. So long as the requesting user has the <code>viewAssetSource</code> permission for the Asset Source the download will work. If the requesting user is logged out then they are automatically redirected to your <code>loginPath</code>.</p>

<p>The only snag I’ve noticed is that Craft does return a JSON formatted error string if your user doesn’t have permission to view the asset. In my case this doesn’t matter, as all authenticated users will have permission to view the files - we’re just trying to prevent guests from seeing them.</p>

<p>Since this approach requires POSTs it’s a bit limiting (secured <code>img</code> tags are a non-starter), but for typical download button use cases it looks fine to me and avoids the need for third party plugins.</p>

<p>(This is a Craft 2 build, I haven’t tested this with Craft 3)</p>

CC BY-SA 3.0
2017-12-29T05:47:20.900Z
In Craft 3, your action would just be `assets/download-asset` instead of `assets/downloadAsset`.
Matt Stein
CC BY-SA 3.0
2017-11-15T14:58:51.390Z
2017-11-15T14:58:51.390Z
Dom Stubbs
<p>There is a plugin from <a href="https://bitbucket.org/jkenters/craft-memberassets/" rel="nofollow">Jeroen Kenters called Member Assets</a> which denies access when logged out.</p>

<p>If you really need a random url, you could extend his plugin.</p>

CC BY-SA 3.0
2014-07-08T12:18:29.377Z
Thanks! The random url is not needed if the asset can be outside of the web root. But this plugin works only where you can specify how the asset is retrieved (e.g. in your own template). It will not work for example when linking to an image asset in a rich text field.
Lars Bilke
CC BY-SA 3.0
2014-07-08T12:27:32.690Z
You could add the link directly into your fields using the reference tag: http://buildwithcraft.com/docs/reference-tags or by entering the id directly `/memberassets/150`.
Victor
CC BY-SA 3.0
2014-07-08T12:45:20.180Z
Yes thats possible but not that client friendly. But thanks anyway!
Lars Bilke
CC BY-SA 3.0
2014-07-08T12:49:57.740Z
You could write a custom redactor plugin, or replace the normal asset link with the secure one in your template.
Victor
CC BY-SA 3.0
2014-07-08T11:25:49.970Z
2014-07-08T11:25:49.970Z
Victor
<p>For a member only area I would like to secure (private) assets:</p>

<ul>
<li>The files should not be accessible when not logged in</li>
<li>The file download URL should be randomly generated and should expire after some time <em>OR</em> the files can be placed above the web root</li>
</ul>

<p>There is for example <a href="http://masugadesign.com/software/link-vault" rel="nofollow">Link Vault</a> for ExpressionEngine which is able to achieve that.</p>

<assets><security>
Is it possible to have secure (private) assets?
# Is it possible to have secure (private) assets?

(Asked by: username_0 on 2014-07-08)

For a member only area I would like to secure (private) assets:

* The files should not be accessible when not logged in
* The file download URL should be randomly generated and should expire after some time *OR* the files can be placed above the web root

There is for example [Link Vault](http://masugadesign.com/software/link-vault) for ExpressionEngine which is able to achieve that.

**Tags:** assets, security


---

## 3 answers

### Answer by username_0 on 2014-10-03. Score: 1 | Accepted answer

There is now the [Internal Assets Plugin](https://github.com/tikiatua/internal-assets-plugin) which allows to place assets above the web root and works as expected.


---

### Answer by username_1 on 2017-11-15. Score: 4

I ran into this requirement today and initially assumed a plugin would be required, but then I spotted that the native Assets action menu already included a Download File option and it was working just fine with files that weren’t publicly accessible. Maybe we could use that rather than reinventing the wheel?
If you check DownloadFileElementAction.php you can see the markup and JS that’s used for this button in the control panel. It generates a simple  tag that POSTs to assets/downloadAsset. With a tiny bit of tweaking that can be converted to a code suitable for use in a frontend template:

    {{ getCsrfInput() }}
    
    
    


This works a treat and includes all native permissions checks as you’d expect. So long as the requesting user has the viewAssetSource permission for the Asset Source the download will work. If the requesting user is logged out then they are automatically redirected to your loginPath.
The only snag I’ve noticed is that Craft does return a JSON formatted error string if your user doesn’t have permission to view the asset. In my case this doesn’t matter, as all authenticated users will have permission to view the files - we’re just trying to prevent guests from seeing them.
Since this approach requires POSTs it’s a bit limiting (secured img tags are a non-starter), but for typical download button use cases it looks fine to me and avoids the need for third party plugins.
(This is a Craft 2 build, I haven’t tested this with Craft 3)

> **Comments:**
> **username_2**: In Craft 3, your action would just be `assets/download-asset` instead of `assets/downloadAsset`.  

---

### Answer by username_3 on 2014-07-08. Score: 3

There is a plugin from [Jeroen Kenters called Member Assets](https://bitbucket.org/jkenters/craft-memberassets/) which denies access when logged out.

If you really need a random url, you could extend his plugin.

> **Comments:**
> **username_0**: Thanks! The random url is not needed if the asset can be outside of the web root. But this plugin works only where you can specify how the asset is retrieved (e.g. in your own template). It will not work for example when linking to an image asset in a rich text field.  
> **username_3**: You could add the link directly into your fields using the reference tag: http://buildwithcraft.com/docs/reference-tags or by entering the id directly `/memberassets/150`.  
> **username_0**: Yes thats possible but not that client friendly. But thanks anyway!  
> **username_3**: You could write a custom redactor plugin, or replace the normal asset link with the secure one in your template.  

---

