Thanks all for the replies!
@mcwumbly Yes, I too was wondering if there might be a same-site restriction? Can you confirm if this is intentional @codinghorror or @sam?
As a side note, this points to one of my goals, which was to have some files which could only be downloaded if the user had access to a particular group. I’ve seen the Site Setting about disallowing anon users from downloading site assets, but I’m guessing that there’s no current way for Discourse to know which category a file was uploaded to and then restrict download access based on group permissions. This question probably deserves a separate topic however…
@thangngoc89, yes, we’re on the latest verison (1.2.0.beta3)