Answers.Body: <p>There is now the <a href="https://github.com/tikiatua/internal-assets-plugin" rel="nofollow">Internal Assets Plugin</a> which allows to place assets above the web root and works as expected.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-10-03T18:51:58.770Z
Answers.LastActivityDate: 2014-10-03T18:51:58.770Z
Answers.UserDisplayName: Lars Bilke
Answers.Body: <p>I ran into this requirement today and initially assumed a plugin would be required, but then I spotted that the native Assets action menu already included a Download File option and it was working just fine with files that weren’t publicly accessible. Maybe we could use that rather than reinventing the wheel?</p>
  
  <p>If you check DownloadFileElementAction.php you can see the markup and JS that’s used for this button in the control panel. It generates a simple <code>&lt;form&gt;</code> tag that POSTs to <code>assets/downloadAsset</code>. With a tiny bit of tweaking that can be converted to a code suitable for use in a frontend template:</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;form method="post" target="_blank" action=""&gt;
      {{ getCsrfInput() }}
      &lt;input type="hidden" name="action" value="assets/downloadAsset" /&gt;
      &lt;input type="hidden" name="assetId" value="123" /&gt;
      &lt;input type="submit" value="Submit" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>This works a treat and includes all native permissions checks as you’d expect. So long as the requesting user has the <code>viewAssetSource</code> permission for the Asset Source the download will work. If the requesting user is logged out then they are automatically redirected to your <code>loginPath</code>.</p>
  
  <p>The only snag I’ve noticed is that Craft does return a JSON formatted error string if your user doesn’t have permission to view the asset. In my case this doesn’t matter, as all authenticated users will have permission to view the files - we’re just trying to prevent guests from seeing them.</p>
  
  <p>Since this approach requires POSTs it’s a bit limiting (secured <code>img</code> tags are a non-starter), but for typical download button use cases it looks fine to me and avoids the need for third party plugins.</p>
  
  <p>(This is a Craft 2 build, I haven’t tested this with Craft 3)</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-12-29T05:47:20.900Z
Answers.Text: In Craft 3, your action would just be `assets/download-asset` instead of `assets/downloadAsset`.
Answers.UserDisplayName: Matt Stein
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-15T14:58:51.390Z
Answers.LastActivityDate: 2017-11-15T14:58:51.390Z
Answers.UserDisplayName: Dom Stubbs
Answers.Body: <p>There is a plugin from <a href="https://bitbucket.org/jkenters/craft-memberassets/" rel="nofollow">Jeroen Kenters called Member Assets</a> which denies access when logged out.</p>
  
  <p>If you really need a random url, you could extend his plugin.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-07-08T12:18:29.377Z
Answers.Text: Thanks! The random url is not needed if the asset can be outside of the web root. But this plugin works only where you can specify how the asset is retrieved (e.g. in your own template). It will not work for example when linking to an image asset in a rich text field.
Answers.UserDisplayName: Lars Bilke
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-07-08T12:27:32.690Z
Answers.Text: You could add the link directly into your fields using the reference tag: http://buildwithcraft.com/docs/reference-tags or by entering the id directly `/memberassets/150`.
Answers.UserDisplayName: Victor
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-07-08T12:45:20.180Z
Answers.Text: Yes thats possible but not that client friendly. But thanks anyway!
Answers.UserDisplayName: Lars Bilke
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-07-08T12:49:57.740Z
Answers.Text: You could write a custom redactor plugin, or replace the normal asset link with the secure one in your template.
Answers.UserDisplayName: Victor
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-07-08T11:25:49.970Z
Answers.LastActivityDate: 2014-07-08T11:25:49.970Z
Answers.UserDisplayName: Victor
Body: <p>For a member only area I would like to secure (private) assets:</p>
  
  <ul>
  <li>The files should not be accessible when not logged in</li>
  <li>The file download URL should be randomly generated and should expire after some time <em>OR</em> the files can be placed above the web root</li>
  </ul>
  
  <p>There is for example <a href="http://masugadesign.com/software/link-vault" rel="nofollow">Link Vault</a> for ExpressionEngine which is able to achieve that.</p>
  
Tags: <assets><security>
Title: Is it possible to have secure (private) assets?
ThreadText: # Is it possible to have secure (private) assets?
  
  (Asked by: username_0 on 2014-07-08)
  
  For a member only area I would like to secure (private) assets:
  
  * The files should not be accessible when not logged in
  * The file download URL should be randomly generated and should expire after some time *OR* the files can be placed above the web root
  
  There is for example [Link Vault](http://masugadesign.com/software/link-vault) for ExpressionEngine which is able to achieve that.
  
  **Tags:** assets, security
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2014-10-03. Score: 1 | Accepted answer
  
  There is now the [Internal Assets Plugin](https://github.com/tikiatua/internal-assets-plugin) which allows to place assets above the web root and works as expected.
  
  
  ---
  
  ### Answer by username_1 on 2017-11-15. Score: 4
  
  I ran into this requirement today and initially assumed a plugin would be required, but then I spotted that the native Assets action menu already included a Download File option and it was working just fine with files that weren’t publicly accessible. Maybe we could use that rather than reinventing the wheel?
  
  If you check DownloadFileElementAction.php you can see the markup and JS that’s used for this button in the control panel. It generates a simple `<form>` tag that POSTs to `assets/downloadAsset`. With a tiny bit of tweaking that can be converted to a code suitable for use in a frontend template:
  
  ```html
  <form method="post" target="_blank" action="">
      {{ getCsrfInput() }}
      <input type="hidden" name="action" value="assets/downloadAsset" />
      <input type="hidden" name="assetId" value="123" />
      <input type="submit" value="Submit" />
  </form>
  
  ```
  
  This works a treat and includes all native permissions checks as you’d expect. So long as the requesting user has the `viewAssetSource` permission for the Asset Source the download will work. If the requesting user is logged out then they are automatically redirected to your `loginPath`.
  
  The only snag I’ve noticed is that Craft does return a JSON formatted error string if your user doesn’t have permission to view the asset. In my case this doesn’t matter, as all authenticated users will have permission to view the files - we’re just trying to prevent guests from seeing them.
  
  Since this approach requires POSTs it’s a bit limiting (secured `img` tags are a non-starter), but for typical download button use cases it looks fine to me and avoids the need for third party plugins.
  
  (This is a Craft 2 build, I haven’t tested this with Craft 3)
  
  > **Comments:**
  > **username_2**: In Craft 3, your action would just be `assets/download-asset` instead of `assets/downloadAsset`.  
  
  ---
  
  ### Answer by username_3 on 2014-07-08. Score: 3
  
  There is a plugin from [Jeroen Kenters called Member Assets](https://bitbucket.org/jkenters/craft-memberassets/) which denies access when logged out.
  
  If you really need a random url, you could extend his plugin.
  
  > **Comments:**
  > **username_0**: Thanks! The random url is not needed if the asset can be outside of the web root. But this plugin works only where you can specify how the asset is retrieved (e.g. in your own template). It will not work for example when linking to an image asset in a rich text field.  
  > **username_3**: You could add the link directly into your fields using the reference tag: http://buildwithcraft.com/docs/reference-tags or by entering the id directly `/memberassets/150`.  
  > **username_0**: Yes thats possible but not that client friendly. But thanks anyway!  
  > **username_3**: You could write a custom redactor plugin, or replace the normal asset link with the secure one in your template.  
  
  ---
  
  