Continuing the discussion from 2.9.0.beta9: Security fix, bug fixes and more:
Why is this disallowed? In earlier versions it seemed to work fine with secure media.
AI-generated summary
The discussion centers on the lack of support for secure uploads in Discourse chat, a feature requested by users to align with the platform’s broader security standards. Alon1 initiated the thread by questioning why chat uploads are disabled when secure_media is enabled, noting that it previously worked. JammyDodger clarified that secure uploads are not currently supported in chat, referencing a commit that explains the technical constraints and offers a workaround for server operators. martin acknowledged the issue, stating that while he plans to address secure media compatibility in chat later in the year, he is currently occupied with other priorities. Alon1 repeatedly bumped the thread over several months to emphasize the importance of the feature for security-conscious users. Teafh reported a related issue where image thumbnails in chat are broken when secure uploads are enabled, asking for a temporary solution. MarkoK inquired about progress, to which mcwumbly confirmed there has been no progress and the feature remains unprioritized. mcwumbly requested anecdotes about how this limitation impacts users to help justify future prioritization. MarkoK shared his use case: building an internal company Discourse where he uses the DISCOURSE_ALLOW_UNSECURE_CHAT_UPLOADS environment variable to allow uploads, restricting private file sharing to other areas. He noted that while not business-critical, consistent secure upload logic between topics and chat would be beneficial. Consequently, mcwumbly moved the topic to the contribution section and updated the title to reflect its status as a feature request.
1 Like
Secure Uploads in Chat aren’t supported at the minute, so it made that setting a little misleading. There’s more detailed info in the commit itself, as well as a workaround if you have server access: 
https://github.com/discourse/discourse-chat/commit/93ab81c725faeca23fbe0bb597a5038382a711e3
4 Likes
Thanks @JammyDodger . Just noting as well that I am queued up on making secure media work with more areas, including chat, later in the year.
6 Likes
Just a kind reminder that secure media is important and useful for some Discourse users 
3 Likes
This is definitely not forgotten, I am the one that will be working on this compatibility, I just have many other things on my plate. Will post updates here when they are ready
5 Likes
Sorry for being annoying about this, perhaps once every 6 month I can send a request to bump this into priority 
2 Likes
6 months have passed and It’s me again 
Please allow uploads to chat when secure_uploads is enabled
See you in 6 months 
4 Likes
In a recent Discourse update, thumbnail preview of images uploaded in chat is broken when secure-uploads is enabled.
I know “This condition can be overridden with DISCOURSE_ALLOW_UNSECURE_CHAT_UPLOADS at operator risk”, but I wonder if there’s any temporary solution for it? @martin
1 Like
Hi everyone! 
Just checking in on the status of this — has there been any progress on making chat uploads compatible with secure_uploads?
1 Like
No, no progress and it’s still not yet prioritized.
This is also still true (perhaps more true):
I do very much want to get to this, but I’m not sure when that’ll happen.
What are you doing currently? Using chat but getting by without uploads?
When was the last time that got in your way?
Hearing little anecdotes here about how the lack of this feature is impacting you and others is helpful any time you have them to share.
1 Like
Thanks for the update!
I am building an internal Discourse for my company use. Same time bringing our instructions, todos, other stuff and our chatting to Discourse.
Now I am getting uploads for chat using the DISCOURSE_ALLOW_UNSECURE_CHAT_UPLOADS env setting. And I instructed that nothing private files/images should be shared using chat. Since this is internal only and forced 2fa and only employees use this Discourse this is fine.
Chat usage is discussing projects/coding/personal stuff so mainly sharing images using chat (photos of issues, personal stuff etc.).
So it is not “business critical” but really nice to have since topics are using secure uploads and it would be great that chat messages used the same logic.
Still. Keep up the great work!
1 Like
I appreciate the extra context. We are doing something similar ourselves.
I’m going to flip this over to Contribute > Feature and change the title since it feels like it’s become the de-facto home for the feature request to support secure uploads in chat.
1 Like