Has anyone got any ideas on how to approach the following:
I generate a pdf receipt and store it in a directory "outside" of
public since I do not want users to be able to just mess about with
URLs and look at other users receipts. However, I do want users to be
able to download and see their own receipt. I am struggling to come
up with a way of the browser showing the pdf but denying access to
other pdf's.
I had thought of using some sort of md5 generated id on a resource
called "receipt" to do a show but in the end there is always some
URL. Is there a way of creating some sort of "one-time-use" URL by
forming the headers accordingly and then simply using a file-read to
serve up the file. To me this seems a bit weird as the whole point of
webservers is doing precisely this.