2

I am debating whether to give my files a public url or a limited private one.

I am hosting various files for a mobile/web application. These will include product images and videos. Currently only authorized users can access this application, and so the files are private. However, I suppose users may want to directly share the file URLs with other users who are not authorized users so they can view them directly (eg through a web browser).

Currently the files are on an AWS S3 bucket (which has no public access) files are given a public url that expires after a short period of time (eg hours). By following this system we also avoid DOS attacks on our S3 bucket.

Am I missing any major reasons to make them public vs private (and the other way around)?

I noticed that facebook used to have persistent file urls for user photos across their CDN, but now they are only valid for an authenticated user (I haven't tested their persistence over time).

Improve this question
2
  • 2
    With public access, a competitor site can also put those images/videos up without having to pay for the hosting/bandwidth costs. Is that acceptable to you?
    – Bart van Ingen Schenau
    Commented Nov 25, 2020 at 10:41
  • this is a good point that people will be able to use our free hosting; although in practice only a small scrappy site would want such an unreliable source of assets (I think).
    – auerbachb
    Commented Nov 25, 2020 at 17:49

1 Answer 1

Reset to default
0

I think Facebook restricted images to authenticated users in an effort to stop "screen scraping" by unknown actors. This also verifies that an image can only be viewed under strict business rules (friends, friends of friends, etc.).

By "public URL", do you mean you have a signature as part of the URL that causes it to expire after a certain time or do you have a token that kills the link when the user's session expires? If the link is still active after a user logs out, even for a short while, that could pose a security risk.

If you've been asked for the ability to share files without the need for a user login, you might consider applying a passcode at the very least to access the file. Otherwise, you're sending a file into the wild to be accessed by whomever has the link without any authentication at all. Not sure what kind of content you're dealing with, but if the file contains personally identifiable information (PII data), that's another security risk.

You should also consider a way to kill any file link immediately by the user in the case that something was sent out that shouldn't have been.

Might bear discussing this further with your IT team to iron out the rules for allowing non-authenticated file access.

Improve this answer
1
  • By "public URL", do you mean... AWS S3 will provide access to the asset via a URL that will not return any asset after the time has run out. During the time the URL is valid there are no limitations on who or how often the asset can be accessed on that URL...I know this doesn't prevent sharing or unauthorized access, but it limits abuse. These assets are product images so they don't need to be super secret...however, as noted we may not simply want them up on the web for anyone to use
    – auerbachb
    Commented Nov 25, 2020 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.