PHP: Secure File Download

gistfile1

<?php
// PHP SECURE FILE DOWNLOAD
// Put the Files in a directory that is not publically accessible.. maybe outside document root or set correct permissions
    
    if (!$_SESSION["authenticated"]) {
        // If not authenticated then send back to the login page
        $host = $_SERVER["HTTP_HOST"];
        $path = rtrim(dirname($_SERVER["PHP_SELF"]), "/\\");
        header("Location: http://$host$path/login.php?err=true");
        exit;
    }

    $file = '/path/to/file/outside/www/secret.pdf';

    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename=' . basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);
    exit;