Symfony2 - how to display content and secure access to it - symfony

Question

I'm developing an application that displays books as interactive flash content with Symfony2. Each book has one index.html file that carries all those flash things embedded in html code and some directories with all required parts of book (images, js files, etc.) linked with this index.html file and each other by 'src' and 'href' tags etc. I'd like to display these books on my website and, at the same time, to prevent anonymous users from downloading them.
For example:
I have my books in web/Books folder and to display Book1 I have to display web/Books/Book1/index.html file. By putting those files in web directory I allow anonymous users to access them by typing for example www.example.com/Books/Book1/index.html or something similar for images, js files etc (paths can be read from content of book's index.html).
Is there any way to prevent from this?
I am an admin of the server, root directory is set on web directory, as recommended.
Thank you in advance for any answers.
EDIT. [SOLVED]
Okay, I found the solution. It's something similar to Pier-Luc's Gendreau proposal.
The idea:
All books are located in 'books' folder, path to index.html of each book is /books/{title}/index.html. In .htaccess I wrote RedirectMatch, for example: /books/book1/index.html is redirected to /bookrouter/book1/index.html. Path like this isn't path to existing file, so Symfony2 can handle it as route. Route pattern is /bookrouter/{path}.{_format} (with requirement for {path} for allowing '/' sign), so I can create accurate response with proper headers and content and serve required files with all required authentication/authorization. There are two bad sides of this:
1. I have to handle each file extension separately to create proper http headers and content.
2. More experienced programmer said that if we will have as many users as we expect, this way of handling each request will kill our server so we can't use it.
So people, thank you for your time! I hope that my solution is described clearly and maybe someone in the future will find it useful. Cheers!

Answer 1

you will need to setup a firewall to deny anonymous users access to certain routes.
See the documentation chapter Security.
For a quick start consider using FOSUserBundle.

Answer 2

Without any modifications to your current structure, I think you're looking for an answer that doesn't exist. The books are outside Symfony, thus ruling out every proper Symfony way of securing access. You're pretty much stuck with basic HTTP authentication with .htaccess.
However, you could bring the books inside Symfony.
Firstly, move your index.html books where the views are stored, renaming every book to it's slug (Book1's index.html becomes Book1.html, etc)
Secondly, create a BookController whose base route is /Books and a secureBookAction with a $slug parameter so that the book route is /Books/{slug}. It seems like you are aware how to secure a route so I'll leave that up to you.
Thirdly, render the view based on the slug parameter. You will probably want to keep a list of the books so you can react properly to a slug that doesn't correspond to a book.
Lastly, I would leave your assets where they are now, just make sure you're using absolute paths otherwise they will break. It'll be simpler that way and they are unlikely to be useful without the accompanying book.
Sorry if my answer is a light on code, I haven't touched anything Symfony in a few weeks though I think I have made the strategy clear.

Answer 3

To secure css, js and image files you should use Assetic, because Assetic generate new URL's for the assets.
For example, here the new URL will be /css/secure :
{% stylesheets '#AcmeFooBundle/Resources/public/css/secure-folder/*' output='css/secure/' filter='cssrewrite' %}
<link rel="stylesheet" href="{{ asset_url }}" />
{% endstylesheets %}
Then you can restrict this route for anonymous users.
# app/config/security.yml
security:
# ...
access_control:
- { path: ^/css/secure, roles: ROLE_USER }