# Is using a GUID for an uploaded filename secure?

**URL:** https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062
**Category:** Development
**Created:** [2017年七月29日 11:53 UTC](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062 "2017-07-29T11:53:48Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![Vitaly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vitaly/32/120475_2.png) [@Vitaly](https://meta.discourse.org/u/Vitaly)
#### Post date: [2017年七月29日 09:57 UTC](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062/6 "2017-07-29T09:57:04Z")

</div>

> [@Quick image resizing and markdown image dimensions](https://meta.discourse.org/t/quick-image-resizing-and-markdown-image-dimensions/66812/22):
>
> I do not see another mean to protect the photos in the forum while still making them accessible from within mail viewers than using random filenames.

In this case you could prepare different content for email and for thread. For example, email can have embedded images (not public accessible link).

The only way to keep public link in secret - never show it anywhere. Seriously.

> Forums that use the Google login must trust Google anyway.

If you trust google auth, that does not mean you should trust it everywhere. I’d like to say that security does not work such way. You must have proofs that all involved 3rd-party services and users do not compromise security. That’s impossible via primitive shared secret without server side check.

---

_[View the full topic](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062)._