# Disallow anonymous users from viewing image & file URLs

**URL:** <https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335>\
**Category:** Feature\
**Created:** [February 29, 2016, 3:55pm UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335 "2016-02-29T15:55:44Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![erlend\_sh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/erlend_sh/32/119475_2.png) [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)\
**Post date:** [February 29, 2016, 3:55pm UTC](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335/1 "2016-02-29T15:55:44Z")

</div>

This came up in an internal discussion. Putting it up here so we can track it.

Discourse image URLs on a invitation-only forum are still publicly viewable. Although these URLs are technically unguessable, e.g.

`/uploads/default/original/2X/4/4150d682b0472888f0014f67f8c09852008067d4.jpg`

… some internal communities deal in such sensitive information that outright disallowing any viewing of these images would be preferable. We do already have a setting for `prevent anons from downloading files`, so the suggestion is to have something similar, but as a global flag for all images & other uploads.

---

_[View the full topic](https://meta.discourse.org/t/disallow-anonymous-users-from-viewing-image-file-urls/40335)._