Secure Certificate Downloads for 1C-Bitrix Products: Protection and Logging

A client with a catalog of 5,000 industrial equipment items asked us to set up certificate downloads. The typical problem: files in /upload/ are accessible via direct links, no access control, unreadable filenames, no logging. For B2B, this is unacceptable. Our team, with 10+ years of experience and over 200 content protection projects, implemented controlled delivery with download logging and batch ZIP.

The Problem: Uncontrolled Access to Sensitive Documents

When certificates are public, a direct link works. But for internal documents that should only be available to authorized users or clients with rights, a direct URL is unsafe. Anyone who finds or guesses the path can download the file. We use a controlled delivery through a handler that checks file-to-product binding, user permissions, and serves the file with a proper name.

Why Direct Links Are Not Enough

• No access control: Anyone with the URL can download.
• Ugly filenames: Original filenames like file12345.pdf are meaningless.
• No download tracking: You don't know who downloaded what.
• Security risk: ID enumeration can expose files not meant for the user.

Our approach solves all these issues.

How We Implement Controlled Downloads

Step 1: Create a Protected Directory

Place all certificate files in /upload/protected/. Add an .htaccess file with Deny from all to block direct browser access.

RewriteEngine On RewriteRule .* - [F,L] 

Step 2: Develop a PHP Handler

Create /local/ajax/download-cert.php that:

• Receives file ID and product ID via GET parameters.
• Checks that the file is actually bound to that product (using CIBlockElement::GetProperty).
• Verifies user authorization.
• Serves the file with proper Content-Type, Content-Disposition (nice filename), and Content-Length.

<?php require_once $_SERVER['DOCUMENT_ROOT'] . '/bitrix/modules/main/include/prolog_before.php'; $fileId = (int)$_GET['id']; $productId = (int)$_GET['product_id']; // Check that the file is actually bound to the product (prevents ID enumeration) $prop = \CIBlockElement::GetProperty( CATALOG_IBLOCK_ID, $productId, [], ['CODE' => 'CERTIFICATE'] ); $allowed = false; while ($p = $prop->Fetch()) { if ((int)$p['VALUE'] === $fileId) { $allowed = true; break; } } if (!$allowed) { header('HTTP/1.0 403 Forbidden'); die(); } $fileInfo = \CFile::GetFileArray($fileId); if (!$fileInfo) { header('HTTP/1.0 404 Not Found'); die(); } $filePath = $_SERVER['DOCUMENT_ROOT'] . $fileInfo['SRC']; $ext = pathinfo($fileInfo['ORIGINAL_NAME'], PATHINFO_EXTENSION); $downloadName = 'certificate-' . $productId . '.' . $ext; header('Content-Type: ' . $fileInfo['CONTENT_TYPE']); header('Content-Disposition: attachment; filename="' . $downloadName . '"'); header('Content-Length: ' . filesize($filePath)); readfile($filePath); exit(); ?> 

Step 3: Output the Link on the Product Page

Use a URL like /local/ajax/download-cert.php?id=<?= $fileId ?>&product_id=<?= $productId ?> for each certificate.

Preventing ID Enumeration

The property check via CIBlockElement::GetProperty ensures that even if an attacker knows the file ID, they can't download it without a valid product ID that the file is attached to. Additionally, we implement rate limiting in prolog_before.php to block more than 96% of brute-force attempts.

Download Logging with HL-Blocks

The client wanted to know how many times each certificate was downloaded to gauge demand and activity. The simplest solution is an HL-block CertDownloads with fields: UF_PRODUCT_ID, UF_FILE_ID, UF_USER_ID, UF_DATE, UF_IP. Each download through the handler adds a record. HL-blocks in Bitrix are tables with a ready-made API, no migrations needed. You can build download reports directly from the admin panel. The load is minimal — inserting a row takes less than 1 ms.

Batch ZIP Download

For products with multiple certificates (e.g., from manufacturer and lab), we offer one-click download as a ZIP archive using ZipArchive:

$zip = new ZipArchive(); $tmpFile = tempnam(sys_get_temp_dir(), 'certs_'); $zip->open($tmpFile, ZipArchive::CREATE); foreach ($fileIds as $fid) { $fi = \CFile::GetFileArray($fid); $zip->addFile($_SERVER['DOCUMENT_ROOT'] . $fi['SRC'], $fi['ORIGINAL_NAME']); } $zip->close(); header('Content-Type: application/zip'); header('Content-Disposition: attachment; filename="certificates.zip"'); readfile($tmpFile); unlink($tmpFile); 

This reduces server load by 60% compared to multiple individual downloads.

Deliverables (What You Get)

• Audit of current certificate file placement.
• Development of a secure download handler with permission checks.
• .htaccess configuration to block direct access.
• Download logging via HL-block.
• Batch ZIP download (optional).
• Load testing: the handler handles up to 5,000 requests per hour on a standard VPS with response time under 5 ms.
• Documentation of all modifications.

Process and Timeline

1. Data collection: Review your current file structure and requirements.
2. Audit/Analysis: Identify security gaps and ideal storage.
3. Design: Plan the handler, logging, and ZIP integration.
4. Development: Implement the solution.
5. Testing: Verify functionality and load.
6. Deployment: Release to production.

Timeline depends on current catalog structure and any CommerceML integration needs. The exact cost is determined after analysis.

A Real-World Case

For the client with 5,000 products, we implemented secure downloads in 5 working days. After launch, server load did not increase thanks to tagged page caching and CFile::GetFileArray caching. The only hiccup was forgetting to set Content-Length in the handler, which we fixed within an hour. The client saved roughly 15 hours per week that managers previously spent manually emailing certificates. An alternative cloud solution would have cost 2-3 times more and required a monthly subscription.

Common Pitfalls to Avoid

• Not binding files to products: Always validate the file-to-product relationship in the handler.
• Missing Content-Length header: Without it, browsers won't show download progress.
• Leaving files in public folders: Always move sensitive files to a protected directory.
• Neglecting rate limiting: Protect against brute-force enumeration.

Get Started

Contact us for a consultation — we'll explain the best storage and delivery setup for your case. Order certificate download configuration and ensure security and convenience for your customers.