.htaccess - htaccess - disallow direct access to all files except logged in users (PHP) -

using .htacess (deny all) - possible allow users logged in system directly access files? if makes difference site built drupal (php). if possible ideally ideally check user's role well.

you cannot .htaccess alone. need is:

1. deny file access all
2. have "file provider" script allows file passthrough after authentication.

example:

proxy.php

<?php  $proxieddirectory = "./files/"; //whatever directory blocked access is. $filename = isset($_get["fn"])?$_get["fn"]:null;  if ($filename === null || !file_exists($proxieddirectory.$filename)) {     http_response_code(404);     exit; }  if (!user_is_authenticated()) { //not real method, use own check     http_response_code(403);     exit; }   $fp = fopen($proxieddirectory.$filename, 'rb');  header("content-type: image/???"); //may need determine mime type somehow header("content-length: " . filesize($proxieddirectory.$filename));  fpassthru($fp); exit; 

and you'd use via:

http://example.com/proxy.php?fn=filename.txt