# Disallow anonymous users from viewing image & file URLs
**URL:** https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335
**Category:** Feature
**Created:** [2016 年 2 月 29 日午後 3:55 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335 "2016-02-29T15:55:44Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [2016 年 2 月 29 日午後 3:55 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/1 "2016-02-29T15:55:44Z")
This came up in an internal discussion. Putting it up here so we can track it.
Discourse image URLs on a invitation-only forum are still publicly viewable. Although these URLs are technically unguessable, e.g.
`/uploads/default/original/2X/4/4150d682b0472888f0014f67f8c09852008067d4.jpg`
… some internal communities deal in such sensitive information that outright disallowing any viewing of these images would be preferable. We do already have a setting for `prevent anons from downloading files`, so the suggestion is to have something similar, but as a global flag for all images & other uploads.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [2016 年 2 月 29 日午後 6:15 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/2 "2016-02-29T18:15:02Z")
Why should there be a separate flag? Just enforce this whenever login\_required is set..?
Or even better, use the permissions from the parent category.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [2016 年 2 月 29 日午後 6:27 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/3 "2016-02-29T18:27:20Z")
I’m thinking we could do it in a middleware, but I’m sure @sam has a better idea 😉
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [2016 年 2 月 29 日午後 6:56 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/4 "2016-02-29T18:56:30Z")
Wouldn’t this impact the following?
- Images displayed in email notifications (appearing broken)
- where images delivered via a proxy (i.e. Gmail)
- generally in mail clients
- CDN delivery
- force cookie based authentication will reduce the effectiveness of a CDN.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016 年 2 月 29 日午後 8:56 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/5 "2016-02-29T20:56:10Z")
This really screws up CDNs so it is a much harder problem than it looks.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2016 年 2 月 29 日午後 10:02 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/6 "2016-02-29T22:02:47Z")
Yeah, you would have to give up on CDN for images or come up with a very elaborate config on fastly if such an option were to exist
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [2016 年 2 月 29 日午後 10:37 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/7 "2016-02-29T22:37:12Z")
Giving up on CDN is a perfectly viable solution in such a case though, since communities under complete lock-down would never surpass a few thousand users and will never see crazy spikes in traffic.
---
### Author:  [@roguemat](https://meta.discourse.org/u/roguemat)
#### Post date: [2017 年 3 月 20 日午前 8:16 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/8 "2017-03-20T08:16:26Z")
We would want this feature and would happily not use a CDN (we aren’t using one now anyway).
---
### Author:  [@jrgen](https://meta.discourse.org/u/jrgen)
#### Post date: [2017 年 9 月 7 日午後 8:09 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/9 "2017-09-07T20:09:45Z")
I am trying to push Discourse as our new forum software (coming from vBulletin), but this might be considered a blocker by the other members.
We deal with very sensitive and personal content, and I believe the idea that an image can potentially be viewed by anyone on the web will scare some of them. Privacy is the #1 concern.
---
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [2017 年 10 月 24 日午前 9:08 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/10 "2017-10-24T09:08:18Z")
I have hit exactly the same issue as @jrgen highlighted and fear that the only option might be to delete all the images transferred from vBulletin and then make it very clear to people that they should only use images for their profile and background that they are happy being potentially publicly associated with their username. Because profile images have URLs like this: `https://forum.example.org/user_avatar/forum.example.org/chrisc/120/26_1.png` (background image URLs are not so bad since they contain a random string).
---
### Author:  [@schungx](https://meta.discourse.org/u/schungx)
#### Post date: [2017 年 10 月 25 日午前 2:41 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/11 "2017-10-25T02:41:53Z")
Forums with sensitive info almost never use CDN to serve those assets. If they do, it is an elaborate setup.
I have business critical and company confidential info inside the forum and technically it is all downloadable by anybody who can guess the name.
---
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [2017 年 10 月 25 日午前 6:55 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/12 "2017-10-25T06:55:42Z")
For one client I setup a Discourse server behind a HTTPS only Ngnix reverse proxy with HTTP Authentication to prevent data leaks of this nature, technically it worked fine, however the usability issues raised by the need for people to enter two usernames and passwords was far too much for non-technical users to cope with so for this reason Discourse was unusable for this job.
Deleting or not allowing images isn’t really practical either — the only workable solution to this is for there to be a settings tick box, for images, as suggested in [the first post in this thread](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335):
> We do already have a setting for `prevent anons from downloading files`, so the suggestion is to have something similar, but as a global flag for all images & other uploads.
---
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [2017 年 10 月 25 日午後 1:13 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/13 "2017-10-25T13:13:00Z")
The client I’m working for at the moment on this is willing to pay for a plugin to solve this issue, see:
> [@\[PAID-job\] Create a plugin to require authentication to access images uploaded to a Discourse server](https://meta.discourse.org/t/paid-job-create-a-plugin-to-require-authentication-to-access-images-uploaded-to-a-discourse-server/72758):
>
> What would you like done? We would like a plugin written that, when enabled, provides a tick box for site admins like the existing “prevent anons from downloading files” option but for images. When ticked this would prevent non-authenticated, anon users from accessing images that are uploaded: Account Profile Picture Account Profile Background Account User Card Background Any image embedded in a Post apart from images posted as attachments to the automatically created “Assets for the site des…
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2017 年 10 月 26 日午前 12:34 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/14 "2017-10-26T00:34:20Z")
> [@schungx](#):
>
> I have business critical and company confidential info inside the forum and technically it is all downloadable by anybody who can guess the name.
We would like to tackle this problem, and have a setting that forces all images and attachments to require a login to view. I think it is a completely valid use case. It is kind of difficult, though. If you wanted to work on it we could fund that work.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [2017 年 10 月 26 日午前 12:43 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/15 "2017-10-26T00:43:04Z")
I started working at a way to get nginx to enforce downloads only for logged in users, but haven’t yet figured out how to do it that way.
I think that it should be reasonable easy to do it with this:
> **[Module ngx\_http\_auth\_request\_module](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html)**
---
### Author:  [@schungx](https://meta.discourse.org/u/schungx)
#### Post date: [2017 年 10 月 26 日午前 2:47 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/16 "2017-10-26T02:47:16Z")
> [@pfaffman](#):
>
> [Module ngx\_http\_auth\_request\_module](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html)
Using such a middleware has the additional benefit of being able to track and trace and log access to sensitive assets, count such access, and run statistics on requests!
EDIT: And you can then fine-tune the access permissions by user, or allow only users that can view the post(s) linking to the asset to download it.
The bad thing is… probably a custom nginx need to be built. That would probably complicate the setup, so this shouldn’t be something that comes as default, right?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [2017 年 10 月 26 日午前 2:55 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/17 "2017-10-26T02:55:49Z")
No. It seems that the stock nginx has all the stuff.
---
### Author:  [@schungx](https://meta.discourse.org/u/schungx)
#### Post date: [2017 年 10 月 26 日午前 2:56 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/18 "2017-10-26T02:56:24Z")
Yup, but not build in by default. I suppose a custom built is needed to include the module.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [2017 年 10 月 26 日午前 2:57 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/19 "2017-10-26T02:57:24Z")
No. I added code to use the module in a standard container and the needed parts seem to be included.
---
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [2017 年 11 月 8 日午前 8:17 UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/20 "2017-11-08T08:17:14Z")
There is now a plugin available for preventing unauthenticated users accessing images, [Discourse Images Guardian](https://github.com/muhlisbc/discourse-images-guardian):
[https://github.com/muhlisbc/discourse-images-guardian](https://github.com/muhlisbc/discourse-images-guardian)
This has been written by @mbcahyono and was paid for by a client, after [advertising the job here](https://meta.discourse.org/t/paid-job-create-a-plugin-to-require-authentication-to-access-images-uploaded-to-a-discourse-server/72758), we are very happy with the result.
[Next page](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335.md?page=2)