0

I built an EE site for a business client several years ago, and they are now asking about my adding a client portal to store and share documents. This would need to be a secure area of the site, as the documents may be sensitive. They are currently on a shared hosting plan. My questions are:

  1. Can I build this in EE, and be confident that it will be adequately secure? Perhaps using Protected Links, Zoo Visitor and SSL certificate, and storing the files above the root?
  2. Would it be better to store files on Amazon S3?
  3. Can it be adequately secure on shared hosting?
  4. Would I serve the client better by recommended a service such as ShareFile or something similar, that could be branded.
1
  1. If the "clients" don't need access to the EE control panel itself, I don't see why you couldn't achieve the basic presentation with a simple set of page templates using the {if logged_in} tag or some such and combining that with an SSL connection. ( http://ellislab.com/expressionengine/user-guide/templates/globals/conditionals.html )

  2. The files themselves might be better secured via Amazon S3, yes, but you could produce a combination of S3 and the approach I've outlined in #1 above. You could secure the template-ed pages via EE's normal means, but build a channel specifically for S3 hosted files. Say, using the default title field, plus an Amazon S3 secured link as a custom field. Typically, S3 links are time sensitive, so the custom field might simply contain the file name. At display time, you could establish a connection to that file name to an S3 bucket containing it using an API key to generate an expiring link. This would help ensure that sharing links with unauthorized users would become pretty useless.

  3. I'd say your definition of "adequate" is important here. The spectrum might range from "DOD"-secure or "I'd be a little embarrassed if this leaked"-secure. Personally, I'd find the above approach reasonably secure, but I wouldn't assume the NSA wasn't downloading those secured files on their donut breaks.

  4. There's a reasonable argument to be made for using a 3rd party file sharing service like Sharefile or Dropbox, yes. However, branding isn't the reason you'd go that route. Using a 3rd party is the no-development-necessary approach. Fast turn up. The upside of the EE approach is that it's fully branded using the site's page templates you already have in place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.