Streaming Secure Files Efficiently With ColdFusion And MOD XSendFile

## NOTE: The installation automatically added this module loader
## into my main httpd.conf file (not shown in the demo).
##
## LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so


<VirtualHost *:80>

	# Define our domain name for local routing.
	ServerName xsendfile.com

	# Define the webroot for the site.
	DocumentRoot "/Sites/bennadel.com/testing/mod_xsendfile/www"

	# Include the ColdFusion connector.
	Include "/private/etc/apache2/cf8-main.conf"

	# Set permissions for web root directory.
	<Directory "/Sites/bennadel.com/testing/mod_xsendfile/www">

		# Enable the use of MOD_XSendFile.

		XSendFile On

		# Allow MOD_XSendFile to access files in the directory
		# parallel to the web root (images). If we don't set this,
		# the MOD_XSendFile will only be able to access files in
		# or below the defined web root.
		#
		# NOTE: This used to be the property, XSendFileAllowAbove,
		# but it has been deprecated in newer versions of the
		# XSendFile module.

		XSendFilePath "/Sites/bennadel.com/testing/mod_xsendfile/images"

	</Directory>

</VirtualHost>

XSendFile On

XSendFilePath "/Sites/bennadel.com/testing/mod_xsendfile/images"

<cfcomponent
	output="false"
	hint="I define the application settings and event handlers.">

	<!--- Define the application settings. --->
	<cfset this.name = hash( getCurrentTemplatePath() ) />
	<cfset this.applicationTimeout = createTimeSpan( 0, 0, 10, 0 ) />
	<cfset this.sessionManagement = true />
	<cfset this.sessionTimeout = createTimeSpan( 0, 0, 10, 0 ) />


	<cffunction
		name="onApplicationStart"
		access="public"
		returntype="boolean"
		output="false"
		hint="I initialize the application.">

		<!---
			Get the path to the images directory. For this demo,
			that is simply the directory paralle to the webroot
			(ie. ../images/).

			NOTE: For this demo, I'm going to use "../" notation for
			path traversal rather than actually calculating the exact
			path - just makes the demo easier to read.
		--->
		<cfset application.imagesDirectory = (
			getDirectoryFromPath( getCurrentTemplatePath() ) &
			"../images/"
			) />

		<!--- Return true so the application can load. --->
		<cfreturn true />
	</cffunction>


	<cffunction
		name="onSessionStart"
		access="public"
		returntype="void"
		output="false"
		hint="I initialize the session.">

		<!---
			Start the user off with a balance (which can be traded
			in for image access).
		--->
		<cfset session.balance = 5.0 />

		<!---
			Keep track of the user's purchases. When the user trades
			in their balance for an image, we will keep a record of
			it so they can access the given files.
		--->
		<cfset session.purchases = {} />

		<!--- Return out. --->
		<cfreturn />
	</cffunction>


	<cffunction
		name="onRequestStart"
		access="public"
		returntype="boolean"
		output="false"
		hint="I initialize the request.">

		<!--- Check for a re-init flag. --->
		<cfif structKeyExists( url, "init" )>

			<!--- Manually reset the application. --->
			<cfset this.onApplicationStart() />
			<cfset this.onSessionStart() />

		</cfif>

		<!--- Return true so the request can load. --->
		<cfreturn true />
	</cffunction>

</cfcomponent>

<!--- Param the photo selection. --->
<cfparam name="url.selectedPhoto" type="numeric" default="0" />

<!--- Set an error message. --->
<cfset errorMessage = "" />

<!--- Set the cost of the photo purhcases. --->
<cfset photoCost = 2 />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!--- Check to see if any photo selection was made. --->
<cfif url.selectedPhoto>

	<!---
		Check to see if the user has enough credits to make the
		given photo purchase (or if they have already purchased
		this photo - in which case, we'll just forward them to
		their purchased photo).
	--->
	<cfif (
		(session.balance gte photoCost) ||
		structKeyExists( session.purchases, url.selectedPhoto )
		)>

		<!---
			For this demo, we don't want to re-charge the user for
			photos they've already purchased. As such, only charge
			them if the photo is not already in the collection of
			purchased items.
		--->
		<cfif !structKeyExists( session.purchases, url.selectedPhoto )>

			<!--- Deduct the credit from the balance. --->
			<cfset session.balance -= photoCost />

			<!--- Add the purchase record. --->
			<cfset session.purchases[ selectedPhoto ] = now() />

		</cfif>

		<!---
			Forward the user to purchase page where they can view
			and download the purchased photo.
		--->
		<cflocation
			url="./purchase.cfm?photo=#url.selectedPhoto#"
			addtoken="false"
			/>

	<cfelse>

		<!---
			The use doesn't have enough balance to make the purchase
			- set an error message to display.
		--->
		<cfset errorMessage = "You do not have enough credits." />

	</cfif>

</cfif>


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<cfoutput>

	<!DOCTYPE html>
	<html>
	<head>
		<title>Using MOD_XSendFile With ColdFusion To Stream Files</title>

		<style type="text/css">

			img {
				border: 5px solid ##454545 ;
				margin-right: 10px ;
				vertical-align: middle ;
				}

			button {
				height: 40px ;
				}

			p.error {
				color: ##CC0000 ;
				font-style: italic ;
				}

		</style>
	</head>
	<body>

		<h1>
			Using MOD_XSendFile With ColdFusion To Stream Files
		</h1>

		<p>
			Credit Balance: <strong>#session.balance#</strong>
		</p>

		<!--- Check to see if there is any error to report. --->
		<cfif len( errorMessage )>

			<p class="error">
				<strong>Oh Noes!</strong> #errorMessage#

				<a href="#cgi.script_name#?init=1">Re-initialize!</a>
			</p>

		</cfif>

		<form action="#cgi.script_name#" method="get">

			<p>
				Please select the image to purchase:
			</p>

			<!--- Output a purchase option for each image. --->
			<cfloop
				index="photoIndex"
				from="1"
				to="15"
				step="1">

				<!---
					Notice that thumbnails are below the webroot
					(can be publicly accessed) but that the original
					image are NOT in the webroot and therefore cannot
					be accessed directly.
				--->
				<p>
					<img src="./thumbs/#photoIndex#.jpg" />

					<button
						type="submit"
						name="selectedPhoto"
						value="#photoIndex#">
						Photo #photoIndex# : #photoCost# Credits
					</button>
				</p>

			</cfloop>

		</form>

	</body>
	</html>

</cfoutput>

<!--- Param the photo id. --->
<cfparam name="url.photo" type="numeric" />

<cfoutput>

	<!DOCTYPE html>
	<html>
	<head>
		<title>Your Download Will Begin Shortly</title>

		<!---
			Forward the user to the download page. This is the
			page that will actually stream the file to client
			(the user's browser).
		--->
		<meta
			http-equiv="refresh"
			content="1; url=./download.cfm?photo=#url.photo#"
			/>
	</head>
	<body>

		<h1>
			Thank You - Your Download Will Begin Shortly
		</h1>

		<p>
			If your download does not begin within a few seconds,
			<a href="./download.cfm?photo=#url.photo#">click here</a>
			to proceed manually.
		</p>

		<p>
			<a href="./index.cfm">Return to Photos</a>
		</p>

	</body>
	</html>

</cfoutput>

<!--- Param the photo id. --->
<cfparam name="url.photo" type="numeric" />


<!---
	Check to make sure the photo is in the user's collection
	of purchases.
--->
<cfif structKeyExists( session.purchases, url.photo )>


	<!---
		The user has made the purchase - add the full file path of
		the purchased image to the outgoing headers. By using the
		XSendFile header, the file streaming will be passed off to
		Apache (ie. it won't tie up a ColdFusion thread).

		NOTE: Apache will strip this header out - it will never
		reach the client.
	--->
	<cfheader
		name="x-sendfile"
		value="#application.imagesDirectory##url.photo#.jpg"
		/>

	<!---
		Deliver this purchased photo as an attachment so
		the "Purchase" screen will not be navigated away from
		(visually speaking).
	--->
	<cfheader
		name="content-disposition"
		value="attachment; filename=purchase-#url.photo#.jpg"
		/>

	<!--- Set the mime-type. --->
	<cfcontent type="image/jpeg" />

	<!---
		Exit the request - we don't really need to do this --
		this is here only to emphasize that ColdFusion is no
		longer doing anything in this request that is realted to
		the file delivery.
	--->
	<cfexit />


<cfelse>


	<!---
		The user has not purhcased this photo. Return an accessed
		denied header response.
	--->
	<cfheader
		statuscode="401"
		statustext="Unauthorized"
		/>

	<h1>
		Access Denied
	</h1>

	<p>
		You are not authorized to access this page.
	</p>


</cfif>