title: Deny access to files without password?
body: <p>I have a framework that I've written. I created a package for said framework that allows me to track my employee's hours, and gives them a place to dump files for the accountant. (Invoices, etc.) </p>
  
  <p>The problem is that these file dumps are accessible through the browser. I could use a <code>.htaccess</code> file to prevent the files from being served up at all, but the problem is that I would like the accountant and the employee to be able to download their files. </p>
  
  <p>A solution might be to read the files with PHP, create a temporary copy, have the user or accountant download that copy, then delete the copy...but this poses two problems. </p>
  
  <p>1) It's going to be time and resource intensive...especially for large files. 
  <br />
  2) For whatever short amount of time, there will be a copy of the file which is accessible to whoever knows the URL. </p>
  
  <p>The other solution would be to put the files outside of the public folder, but the problem is that I would like this package to be portable, and a lot of my servers are shared. </p>
  
  <p>What method could I use to be able to serve the files only when authenticated, and avoid the flaws I described above? </p>