fetchfile.php is the authenticated file-serving endpoint that gates access to every file stored in a private path. It checks who's asking, what they want, whether they're allowed to have it, and then streams the bytes (or refuses).
How It Works
- Request hits
/fetchfile.php?id=<file-id>&token=<short-lived>. - Server validates the token (signature + expiry).
- Server looks up the file record. If linked to a parent record, server checks the user can see the parent.
- Server fetches bytes (from S3, local disk, or wherever the file store points).
- Server streams the response with the right Content-Type and a Content-Disposition that triggers display or download as appropriate.
- Access logged.
Security Properties
- No direct URL access: Even if someone learns the underlying storage path, they can't fetch it directly.
- Permission inheritance: If you can't see the order, you can't see its attached invoice.
- Token expiry: URLs included in emails expire after 24 hours; share-with-others URLs can be set shorter.
- Audit trail: Every fetch is logged with user, file and IP.
Performance Tuning
- Enable byte-range support so video players can seek.
- Use signed S3 URLs for large files (handoff the streaming to S3 directly while still doing auth on the way in).
- Cache permission lookups for hot files within a request to avoid repeat queries.
Worked Examples
- Patient record access: Doctor opens patient record; PDF reports linked. Clicking a PDF goes through fetchfile.php — confirms the doctor has access to the patient, then streams.
- Order invoice link: Order confirmation email contains a fetchfile URL with a 7-day token. After 7 days the customer signs in normally to see invoices.
- Embedded video: Internal training portal uses fetchfile-served videos; player byte-range support lets users skip to chapters efficiently.