I am building a platform like Steam and, like Steam, I'd like to prevent users from downloading games they have not purchased yet. For example I don't want users to be able to download a game just because they know the SFTP link to it on my servers.

How can I accomplish this?

  • 1
    \$\begingroup\$ Questions about how a specific project works aren't on-topic here; I've edited the question to ask about how you might accomplish this if you were building your own service, which is on-topic here. \$\endgroup\$
    – user1430
    Mar 14, 2017 at 18:20

1 Answer 1


For this you would require an implementation of user authorisation (wikipedia).

This could be implemented in many different ways. You will need to look at your requirements and see what needs will be necessary to fulfil.

For example, you could create a simple database where you update a user's privileges after having received a legitimate purchase. Your SFTP-server could integrate with this database to retrieve information about the user's access rights. If the user is allowed to download the resource via the link, the SFTP server can return the downloadable resource, or otherwise reject the user's request.

Another option is to add a proxy, that handles the authorisation of the users, in front of the SFTP server so that the SFTP server is hidden on a local network and only accessible from the proxy. Then the proxy will be in charge of only granting access to legitimate customers.

You can make it as complex or simple as you'd like!


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .