# Secure Media Uploads breaks Group flair image

**URL:** https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671
**Category:** Support
**Created:** [December 18, 2020, 1:02am UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671 "2020-12-18T01:02:10Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Benjamin\_D](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/benjamin_d/32/277831_2.png) [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [December 18, 2020, 1:02am UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671/1 "2020-12-18T01:02:10Z")

</div>

2.7.0.beta1 ( [ae114a6ee8](https://github.com/discourse/discourse/commits/ae114a6ee8f2e4f9abd1bbd536d34e6bc55fea23) )

I assume it has something to do with secure media because the upload of an image as group flair still works (it has the X-amz credentials) but after a refresh the display of said image gives a 403, access denied (the X-amz credentials are missing). Groups flair Icons work fine, and otherwise uploads, avatars, category logos, also fine.  
It seems quite similar to this one [Secure Media Uploads breaks Category Logos - #2 by martin](https://meta.discourse.org/t/secure-media-uploads-breaks-category-logos/161693/2) , but I’m almost sure I has worked between the fix of Martin and now (worked with 2.6.0 beta5 if I’m not mistaken).

---

<div class="post-metadata">

### Author: ![Benjamin\_D](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/benjamin_d/32/277831_2.png) [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [February 14, 2021, 8:23pm UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671/4 "2021-02-14T20:23:20Z")

</div>

I still can’t make it work ( 2.7.0.beta3 ( [7fe5368718](https://github.com/discourse/discourse/commits/7fe536871873c911a1a5a6f006408c1579909563) ) ) 🥺

I wonder if `group_flair` shouldn’t be a public type ?

> <https://github.com/discourse/discourse/blob/7fe536871873c911a1a5a6f006408c1579909563/lib/upload_security.rb#L21-L28>

---

<div class="post-metadata">

### Author: ![martin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/martin/32/491371_2.png) [@martin](https://meta.discourse.org/u/martin)
#### Post date: [February 15, 2021, 4:14am UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671/5 "2021-02-15T04:14:52Z")

</div>

> [@Benjamin\_D](#):
>
> group\_flair

You are right, I am making a fix for this here, which will include a migration to fix incorrectly marked secure group flair uploads [FIX: Do not mark group\_flair images as secure on upload by martin-brennan · Pull Request #12081 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/12081)

---

<div class="post-metadata">

### Author: ![Benjamin\_D](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/benjamin_d/32/277831_2.png) [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [February 16, 2021, 12:29pm UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671/10 "2021-02-16T12:29:42Z")

</div>

![](https://global.discourse-cdn.com/meta/original/3X/7/e/7e1a537e47e1485de0ff9e6b39618b2d0d83e45c.webp)

and it’s working 😄 👍

---

<div class="post-metadata">

### Author: ![martin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/martin/32/491371_2.png) [@martin](https://meta.discourse.org/u/martin)
#### Post date: [February 24, 2021, 2:15am UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-group-flair-image/173671/11 "2021-02-24T02:15:29Z")

</div>