Skip to main content

Header

File Hosting & Digital Downloads

The File Hosting & Digital Downloads System on BDX.market manages the distribution of non-serial digital assets, including digital software installers, game client patches, high-resolution graphics bundles, digital guides, custom game mods, and electronic documents.

To provide fast, reliable downloads for users across Bangladesh while preventing hotlinking and unauthorized distribution, BDX.market combines secure Cloudflare R2 / S3 object storage with time-limited signed URLs, bandwidth optimization, and virus scan validation.

1. System Architecture & Infrastructure​

Digital file delivery relies on an isolated storage architecture that decouples web app servers from high-bandwidth asset transfers. All uploaded seller assets are stored in encrypted private buckets on object storage and served via localized CDN nodes.

 +------------------+        +-------------------+        +--------------------+
 | Seller File Upload| ----> | Malware / Virus   | ---->  | Private S3 / R2    |
 | (Dashboard)      |        | Scanner Service   |        | Bucket (No Public) |
 +------------------+        +-------------------+        +--------------------+
                                                                     |
                                                                     v
 +------------------+        +-------------------+        +--------------------+
 | Direct Download  | <----  | Short-Lived Signed| <----  | Buyer Requests File|
 | From CDN Edge    |        | Delivery URL      |        | (Verified Purchase)|
 +------------------+        +-------------------+        +--------------------+

Technical Highlights​

  1. Private Object Storage: Files are stored with strict Private Access Control Lists (ACLs). Public direct URLs do not exist; all access requires cryptographic signature verification.
  2. Edge CDN Acceleration: Download requests are cached and routed through Cloudflare edge nodes serving South Asian traffic, maximizing download throughput on local broadband and mobile data connections in Bangladesh.
  3. Chunked Resumable Transfers: Supports HTTP Range requests, enabling buyers on variable mobile networks to pause and resume multi-gigabyte file downloads without corruption.

2. File Ingestion, Malware Scanning & Validation​

To maintain platform security, all seller-uploaded files undergo rigorous automated validation before becoming available for purchase or download.

Supported File Formats & File Size Caps​

Asset TypeAllowed ExtensionsSize LimitStorage Tier
Software & Utilities.exe, .msi, .zip, .7z, .tar.gz5.0 GBStandard R2 Object Storage
Digital Guides & Books.pdf, .epub500 MBStandard R2 Object Storage
Graphics & Art Packs.zip, .psd, .png, .svg, .rar2.0 GBStandard R2 Object Storage
Game Mods & Addons.zip, .rar, .pak10.0 GBHigh-Capacity Storage Tier

Malware & Antivirus Inspection Protocol​

When a seller uploads a digital package:

  1. MIME & Extension Validation: The server verifies file magic bytes to block disguised executable threats (e.g., .exe masked as .pdf).
  2. Automated ClamAV / VirusTotal Scanning: Files are scanned for malware, trojans, cryptominers, and malicious scripts.
  3. Quarantine State: Uploaded assets remain in status = 'pending_scan' until security clearance is achieved. Assets failing security checks are automatically purged, and the seller account is flagged for review.

3. Storage Architecture: digital_file_assets​

Metadata for digital assets, file checksums, and delivery statistics are recorded in the digital_file_assets table.

CREATE TABLE `digital_file_assets` (
  `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
  `uuid` CHAR(36) NOT NULL UNIQUE,
  `offer_id` BIGINT UNSIGNED NOT NULL,
  `seller_id` BIGINT UNSIGNED NOT NULL,
  `original_name` VARCHAR(255) NOT NULL,
  `storage_path` VARCHAR(255) NOT NULL,
  `mime_type` VARCHAR(255) NOT NULL,
  `file_size_bytes` BIGINT UNSIGNED NOT NULL,
  `sha256_checksum` CHAR(64) NOT NULL,
  `scan_status` ENUM('pending', 'passed', 'failed') NOT NULL DEFAULT 'pending',
  `download_count` INT UNSIGNED NOT NULL DEFAULT 0,
  `created_at` TIMESTAMP NULL,
  `updated_at` TIMESTAMP NULL,
  FOREIGN KEY (`offer_id`) REFERENCES `seller_offers` (`id`) ON DELETE CASCADE,
  FOREIGN KEY (`seller_id`) REFERENCES `users` (`id`)
);

Integrity Verification via SHA-256​

The sha256_checksum is calculated upon upload completion and displayed on the buyer’s download panel. Buyers can verify downloaded files locally against this hash to ensure zero corruption or tampering during transmission.

4. Signed URLs, Hotlink Protection & Bandwidth Management​

To prevent link sharing, unauthorized scraping, and bandwidth theft, file access relies on short-lived HMAC-signed URLs generated on demand.

Signed URL Generation Engine​

When an authorized buyer clicks Download File within their order panel (/orders/{order_id}):

  1. The application checks order state (status IN ('paid', 'delivered', 'completed')) and buyer authorization.
  2. The server constructs a temporary signed Amazon S3 / Cloudflare R2 URL valid for exactly 15 minutes.
  3. The response issues a 302 Found redirect directly to the edge CDN download link.
use Illuminate\Support\Facades\Storage;

public function generateDownloadUrl(DigitalFileAsset $file, User $buyer): string
{
    // Verify buyer owns active order for this file asset
    $hasValidOrder = BdxOrder::where('buyer_id', $buyer->id)
        ->where('offer_id', $file->offer_id)
        ->whereIn('status', ['paid', 'delivered', 'completed'])
        ->exists();

    if (!$hasValidOrder) {
        abort(403, 'Unauthorized access to digital download.');
    }

    // Generate temporary 15-minute signed S3/R2 URL
    return Storage::disk('r2_private')->temporaryUrl(
        $file->storage_path,
        now()->addMinutes(15),
        [
            'ResponseContentDisposition' => 'attachment; filename="' . $file->original_name . '"',
            'ResponseContentType' => $file->mime_type,
        ]
    );
}

Hotlink Protection & IP Binding​

Signed URLs incorporate the buyer's IP address and session token signature. If a buyer attempts to post a signed link on public forums or social media:

  • External users attempting to access the link are denied access (403 Forbidden).
  • Link expiration after 15 minutes forces secondary requests back through BDX authentication.

5. Download History, Re-Downloads & Access Expiration​

BDX.market provides clear download rights while maintaining storage governance.

Lifetime Re-Download Access​

Once an order is confirmed, buyers enjoy unlimited re-download access to their purchased file assets directly from their Order History panel. Even if a seller subsequently unpublishes their product listing, historical buyers retain download permissions for their purchased version.

Versioning & Seller Asset Updates​

If a seller releases an updated version of a software tool or digital book (e.g., v1.0 to v1.2):

  • The seller uploads a new package revision in their dashboard.
  • Existing buyers receive an automated notification: "An updated version of your purchased asset is available."
  • Version history logs maintain access to both original and updated files.
Last updated on