# Attachments available to any user with link

**URL:** https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868
**Category:** Feature
**Created:** [14 Agosto, 2014 21:52 UTC](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868 "2014-08-14T21:52:14Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![dmitry\_fedyuk](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dmitry_fedyuk/32/293153_2.png) [@dmitry\_fedyuk](https://meta.discourse.org/u/dmitry_fedyuk)
#### Post date: [10 Junio, 2015 05:49 UTC](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868/7 "2015-06-10T05:49:28Z")

</div>

> [@lake54](#):
>
> Create a restricted category, and post an attachment in there.  
> With another account, one that doesn’t have access to the restricted category, try and access the uploaded file (e.g. the original user has copied the link, perhaps in a forwarded email by mistake)  
> User is able to access the file

My «[Restrict Files](https://meta.discourse.org/t/restrict-files-plugin-sell-a-digital-content-on-your-discourse-forum/29775)» plugin solves the problem of unauthenticated / unautorized access to attachments:

 ![](https://global.discourse-cdn.com/meta/original/3X/0/d/0df1fc2dbb2223412c42dff504c7fc5676c26e92.png)  
The plugin automatically generates a new attachment URL, so the real file path / url is not exposed.  
Now, the attachments are not static content anymore: they served dynamically through the plugin who controls access permissions.  
And now you can setup your web server (Thin or Nginx) for permormance and serve the remaining static content (inline images) directly (not passing it to Rails). It can considerably speed up your Discourse site.

Notice:

- a permitted user sees the real human readable file name when he has downloaded a restricted file.

- a restricted file has a short, clean URL like [http://discourse.pro/file/113](http://discourse.pro/file/113)  
We do not prohibit users from sharing a private attachment link anymore.  
Quite the contrary the sharing of private attachments by forum members is now in favour of the a forum owner: when someone unauthenticated or unauthorized clicks a private attachment link he sees how to buy the file (or what else he should do to gain the access).  
The plugin is SEO friendly: it does not return 404 blank page on unallowed access (as Discourse core does for attachments available only to logged in), but returns the correct HTTP 401 code for unauthenticated (not logged in) access and HTTP 403 code for unauthorized access with rich HTML customizable messages in the both cases. So Google knows than a private file is not broken, the file is actually exists but restricted.

---

_[View the full topic](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868)._