Allowing access to files only for users that purchased it-CodePudding

I have a folder on the server named uploads where uploaded files are stored (images) on requests made to the server to get a file I want to verify if the user has purchased it. Ids of purchased products by the user are stored on a user object in MongoDB. So I think that I should somehow attach the product id to the request or URL to then check if it exists in the user object, but where to attach it and how or maybe there is a better solution how would you tackle that?

CodePudding user response：

As you already using MongoDB (even though I would suggest a relational DB for this case), I believe one approach would be to create a "middle" table called "purchased_images", linking the user_id with the image_id.

CodePudding user response：

In the frontend you can write an ajax to pass the userid and itemid .You must session to do this. when the user click verifyItembutton you can call a function by something like this

<button onclick="checkItem(userid,productId)">verifyItem</button>

Then in your script file you can call ajax

function checkItem(userid,proId) {
let data = {
    userid,
    proId,
}
$.ajax({
    type: "post",
    url: "/foo",
    data: data,
    success: function (response) {
        console.log(response);
    }
});

}

Now in your route file you can add a route /foo and you can perform mongo queries to find whether the user own it and return a boolean value the value will be sent to client side ajax and you can do whatever you need based on the state in success function of ajax

hope it helped you feel free to ask any doubts !