title: coldfusion - prevent direct access to files created by user that are meant to be downloaded
body: <p>When a user logs into our system, it's possible for the user to create a CSV report.  This report can then be downloaded by the user.  Directory structure is like this:</p>
  
  <pre><code>siteroot.com/user/
  siteroot.com/user/login/
  siteroot.com/user/login/downloads/[file].csv
  </code></pre>
  
  <p>The /login/ directory can only be accessed via a logged in user.  However someone - if they knew the URL - could go directly to the URL of the CSV file and grab the file:</p>
  
  <pre><code>siteroot.com/user/login/downloads/myfile.csv
  </code></pre>
  
  <p>Is there any better (simpler) solution than moving them out of the root and then using a cfdirectory / cfheader / cfcontent to pull the CSV file out of a non-IIS directory and give it to the user?</p>