I am working on a file sharing web application. This application is being developed using jsp and servlet, MySql, Apache tomcat 6.0 webserver and Eclipse Juno IDE. My expert level is beginner to these given technologies.
This application have a file upload utility. Under this utility user enters some basic information regarding file in a HTML form and gives path to file on local machine using browse button. When User clicks on Submit button the data in form is saved in database and the file is gets uploaded on server on a fix common location specified by application. While uploading a file to server this utility will create a directory on given fix common location and upload the file in this created directory.
I have following questions and doubts regarding which I want guidance and solution from experts.
Currently I have my web server and database server on same machine and the file uploaded are also on same web server in the applications directory. I want to put the uploaded files very secure. I want to ask experts whether is this kind of setup is Correct or is there any other secure and perfect setup design for the same situation?
The number of users logged in to application is not decided yet but it may be from few numbers to thousand. There is no restriction on count of Uploading file. So finally the total size of files uploaded by all users in fix common location may be in GB's or in few tb's Currently no issues regarding disk space required but still suggestion and guidance regarding this is always welcome
As the process mentioned above I need to create a directory on given fix common location. Whether the server or other security application on server will going to allow me to create directory on fly that fix common location?
Is it a good practice to put the uploaded files in its own web application folder?
Thank You!
1) I would recommend to save the uploaded files in your database. In this manner you will have an extra layer (db security) of added security and reliable storage, without the need to sort files in directories.
2) To be able to decide for your disk storage, it is crucial to know in advance proximately the average file size to be uploaded and the number of users to use the application. If you take into consideration my point above and you use a database, there are methods to extend your database size for extra scalability in case you need it.
3) Yes directory creation is allowed as long as you have enough permissions to do so from your OS.
4) NO! Don't do it. Consider the case you want to redeploy your application.