# Emoji Picker is not not using CDN URLs for custom emojis

**URL:** <https://meta.discourse.org/t/emoji-picker-is-not-not-using-cdn-urls-for-custom-emojis/363404>\
**Category:** Bug\
**Tags:** emoji\
**Created:** [April 25, 2025, 7:28am UTC](https://meta.discourse.org/t/emoji-picker-is-not-not-using-cdn-urls-for-custom-emojis/363404 "2025-04-25T07:28:22Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![lava](https://avatars.discourse-cdn.com/v4/letter/l/a4c791/32.png) [@lava](https://meta.discourse.org/u/lava)\
**Post date:** [April 29, 2025, 2:49am UTC](https://meta.discourse.org/t/emoji-picker-is-not-not-using-cdn-urls-for-custom-emojis/363404/9 "2025-04-29T02:49:05Z")

</div>

Thank you for your PR that enables CDN usage for custom emojis.

While your frontend fix correctly requests emoji CDN addresses, I’m concerned about backend security.  
The `https://meta.discourse.org/emojis.json` endpoint still exposes S3 source URLs like `//cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/meta/original/3X/6/1/61e481320406f0f82ed780db3f04056128191613.png`, which could potentially lead to malicious abuse and excessive S3 billing.

For better security, I suggest returning CDN addresses directly, similar to how non-custom emojis are handled.

Here’s my attempt at fixing the code:

```ruby
class EmojisController < ApplicationController
  def index
    emojis = Emoji.allowed.group_by(&:group)
    
    emojis.each do |_, emoji_list|
      emoji_list.each do |emoji|
        emoji.url = Discourse.store.cdn_url(emoji.url) if emoji.url.present?
      end
    end
    
    render json: MultiJson.dump(emojis)
  end
  def search_aliases
    render json: MultiJson.dump(Emoji.search_aliases)
  end
end

```

---

_[View the full topic](https://meta.discourse.org/t/emoji-picker-is-not-not-using-cdn-urls-for-custom-emojis/363404)._