Disallow anonymous users from viewing image & file URLs

Feature
21

Wonderful!

@mbcahyono could you please create a new topic for the plugin in plugin?

3 Likes
22

The Discourse Images Guardian plugin no longer works with the latest Discourse beta — you can’t set a URL for the logos any more so all images now require authentication, this results in the site logos returning 404’s for non-authenticated users, I have opened an issue for this on GitHub to see if we can find a way to solve this.

23

The Discourse Images Guardian has been updated by @mbcahyono so it now works with the latest Discourse beta, I have deployed it to a couple of servers running v2.3.0.beta1 :slight_smile:.

4 Likes
24

The Discourse Images Guardian plugin doesn’t currently work with the latest Discourse v2.3.0.beta5, I have had to disable it on a couple of sites. I have raised an issue for this on GitHub and hopefully @mbcahyono will have a suggestion for a fix for this soon.

2 Likes
25

Today we began internally trialling a new “secure media” setting, which is only usable if S3 uploads are enabled. What this will do is the following:

  • For Discourse instances that have the “login required” setting enabled, all uploads are considered secure, but if the setting is not enabled, only private message uploads are considered secure.
  • All securely uploaded media URLs within posts and private messages will no longer directly point to the file, but will go through an endpoint to determine access to the media first based on site settings.
  • Secure media in emails are replaced by placeholder text prompting users to log in to the Discourse instance to view the media.
  • If an upload has been used in a secure context previously, we do not allow posting the same upload in a public topic.

This setting is currently only available for self-hosted Discourse instances. We will provide further updates once we have completed internal trials.

13 Likes
26

What are the downsides of this? Does it effect performance at all?

27

The URL for media in posts/private messages is simply replaced with a Discourse server URL which then serves the private S3 URL for the upload.

2 Likes
28

Just to clarify here.

The downside is that you can not use a CDN anymore for private stuff and every image request / download has to “pipe” through the app to unlock the bucket for a user.

On small internal forums it is very unlikely you will notice anything. On a huge forums that require login, giving up the CDN and piping requests via the app may have some impact.

6 Likes