ostap
Is limiting access to user-uploaded static files worth it?
I’m building a file converter website which does not require an account. It stores all conversions in the database and assigns owned conversions to a session as a list of IDs.
I don’t use S3 yet, so all converted files are stored in a priv/static/uploads.
defmodule MyAppWeb do
def static_paths, do: ~w(uploads
These files are mostly stored temporarily and deleted after 24 hours. But there would be the case when we store them longer if someone makes an account.
Is it acceptable to keep these files publicly exposed? Is it better to somehow authenticate access to these files? If so, is there an easy way to do so with Plug/Phoenix?
Marked As Solved
D4no0
You can just use authentication plug for the static files?
The way I did it back in the day is that I would have a dedicated controller that would serve the files based on the authenticated user, as most probably you won’t want authenticated users to see each-other’s files.
Also Liked
ostap
Thank you! A dedicated controller for serving files seems to be what I want. I can also make it domain-specific so that it fetches the database record and checks the ownership to then decide whether to serve the file.
I now think my file-serving controller could benefit from utilizing Nginx’s X-Accel-Redirect header to send over large files.
garrison
You could give each file an unguessable “token” and allow download via that token. Depending on your use case this could be handy for allowing a user to send the download link to someone else (or another computer).
:crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
If a logged-in user wants a truly “private” (authenticated) upload then you could make the token optional in the schema (or better, a “visibility” field) and authenticate accordingly.
Last Post!
garrison
You could give each file an unguessable “token” and allow download via that token. Depending on your use case this could be handy for allowing a user to send the download link to someone else (or another computer).
:crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
If a logged-in user wants a truly “private” (authenticated) upload then you could make the token optional in the schema (or better, a “visibility” field) and authenticate accordingly.
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Deploy Phoenix to your own VPS with PaaS ease: push-to-deploy, zero downtime, auto SSL, managed Postgres. 14-day free trial at potions.io
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking for Elixir devs who love to ship. Start your free account.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
Producing high quality Elixir screencasts since 2017.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"