# Attachment / Upload email links now throw 404 if not logged in (SSO)
**URL:** https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719
**Category:** Bug
**Created:** [13 Gennaio 2017, 7:14pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719 "2017-01-13T19:14:51Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@wesochuck](https://meta.discourse.org/u/wesochuck)
#### Post date: [13 Gennaio 2017, 7:14pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/1 "2017-01-13T19:14:51Z")
I’ve been getting user complaints since our upgrade to v1.8.0.beta1 +3 last week, so this seems to be due to a recent change (sorry we don’t have an older environment for me verify).
We are an environment that requires all users to be logged in via SSO to be able to interact with our forum.
**Before the upgrade** , a user could click on a link to a file in their email (either from a digest for mailing list mode) and download the associated file. It appears this could happen **even if they weren’t logged into Discourse**.
**After the upgrade** , when a user clicks on a link to a file from their email and they haven’t logged in, they get a 404 error.
* * *
What were getting is regular complaints from users that the links we’re sending via email are broken because they don’t know that they need to log in FIRST and then click on the link.
While I’m in favor of not allowing them to view the file until they log in, it is confusing to them that it generates a 404 error. **I think that a 401 or a 403 with the prompt to log-in via SSO would be more appropriate**.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [13 Gennaio 2017, 7:51pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/2 "2017-01-13T19:51:40Z")
Have you enabled the site setting to disallow downloads for anon users? Can you repro this here on meta?
---
### Author:  [@wesochuck](https://meta.discourse.org/u/wesochuck)
#### Post date: [13 Gennaio 2017, 7:53pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/3 "2017-01-13T19:53:59Z")
> [@codinghorror](#):
>
> Have you enabled the site setting to disallow downloads for anon users?
No, that setting is not enabled:
> [@codinghorror](#):
>
> Can you repro this here on meta?
Doesn’t meta allow read-only even if you’re _not_ logged in? Our site doesn’t allow you to do _anything_ until you’ve logged in. In order to fully repro, I’d need another site that requires you to be logged in for all transactions (and preferably logged in via SSO).
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [13 Gennaio 2017, 7:55pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/4 "2017-01-13T19:55:52Z")
Not sure, maybe @zogstrip can take a look next week. This must be login-required specific?
---
### Author:  [@wesochuck](https://meta.discourse.org/u/wesochuck)
#### Post date: [13 Febbraio 2017, 3:15pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/5 "2017-02-13T15:15:39Z")
Still seeing this on v1.8.0.beta4 +72. Wondering if something similar to what was done over here could be put in place for upload links:
> [@\`/my/preferences\` should not take you to a 404 page](https://meta.discourse.org/t/my-preferences-should-not-take-you-to-a-404-page/34472):
>
> We link http://sitename/my/preferences in a bunch of places in emails with text similar to: "To change your preferences click: http://sitename/my/preferences. If a user is not logged in clicking on that link takes you to a 404, this can be very confusing, especially for mailing list migrations. Instead we should have a special /my/preferences page for anon that explains they are not logged in and provides instructions on how to log in. cc @eviltrout
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [22 Maggio 2017, 2:05pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/7 "2017-05-22T14:05:38Z")
I think @techAPJ fixed that issue recently. Can you update and confirm?
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [22 Maggio 2017, 2:24pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/8 "2017-05-22T14:24:21Z")
I did not fix this particular bug. What I did was show a _nicer_ 404 page (as opposed to blank page) when trying to access an attachment as anon.
> [@wesochuck](#):
>
> Our site doesn’t allow you to do anything until you’ve logged in.
Okay, so I believe you have “login required” setting enabled? If yes, an anonymous user can’t view/download that attachment because they are not logged in.
---
### Author:  [@wesochuck](https://meta.discourse.org/u/wesochuck)
#### Post date: [23 Maggio 2017, 1:17pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/9 "2017-05-23T13:17:48Z")
> [@techAPJ](#):
>
> Okay, so I believe you have “login required” setting enabled? If yes, an anonymous user can’t view/download that attachment because they are not logged in.
Yes, we do have the setting enabled and we appreciate that Discourse no longer allows to download the attachment without logging in. But we are still having some confusion from users that get an email notice, click on the link to download the attachment and because they weren’t already logged in are confused about what their next step should be.
I upgraded last night and the _Oops page_ is an improvement over the generic 404 we were getting before. However, I notice that **if you do login from that page, you aren’t redirected to the attachment or the post with the attachment** , instead you just land at the “root” of the site.
Has there been any thought to redirecting the user once they login to the URL that they were attempting to originally access? (I’m happy to open that as a separate feature request as I think that happens from other pages as well.)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [23 Maggio 2017, 7:01pm UTC](https://meta.discourse.org/t/attachment-upload-email-links-now-throw-404-if-not-logged-in-sso/55719/10 "2017-05-23T19:01:02Z")
I believe you get redirected from other URLs on login but feel free to test and let us know.