Secure Uploads

[martin (Martin Brennan)]

Added in the Discourse 2.4 release in February is the Secure Uploads feature, which provides a higher degree of security for ALL uploads (images, video, audio, text, pdfs, zips, and others) within a Discourse instance.

Prerequisites

You must have S3 uploads enabled on your site, which needs the following settings to be filled:

• S3 access key id
• S3 secret access key
• S3 region
• S3 upload bucket

You also must be using an S3 bucket that does not have a Public bucket policy, and you need to make sure that all existing uploads have a public-read S3 ACL. See the “Enabling Secure Uploads” below.

After these prerequisites are satisfied you can enable the “secure uploads” site setting.

Enabling Secure Uploads

HERE BE DRAGONS

This is an advanced feature and support outside of our Enterprise tier will be limited at best. Only enable secure uploads if you are an expert user.

---

To enable secure uploads, you need to follow these steps:

1. Ensure you have S3 uploads configured.
2. Take note whether your S3 bucket has a Public bucket policy. If it is, there is an additional step required (step 4).
3. Run the uploads:sync_s3_acls rake task. This will make sure all your uploads have the correct ACL in S3. This is important; if you do step 4 before doing this some uploads may become inaccessible on your forum.
4. Remove the Public bucket policy from your bucket if it was present in step 1.
5. Enable the “secure uploads” site setting. Optionally enable the “prevent anons from downloading files” site setting to stop anonymous users downloading attachments from public posts. Any uploads from this time on could possibly be marked as secure depending on the conditions below.
6. If you want all uploads retroactively to be analysed and possibly marked as secure, run the uploads:secure_upload_analyse_and_update rake task.

Note on S3 bucket policy

You need to make sure is that the bucket you are uploading to does not have a Public bucket policy. A public bucket policy will have something like this:

{
    "Version": "2012-10-17",
    "Id": "ComputedBucketPolicy",
    "Statement": [
        {
            "Sid": "AllowWorldRead",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        }
    ]
}

The important part here is that we are Allowing * to GetObject, which is saying let anyone download anything in the bucket. This label will also show if the policy is Public:

The settings here should not be touched. Pictured is the ideal state for the “Block public access” tab:

What it does

Once you have enabled Secure Uploads, any file uploaded via the Composer will either be marked as secure or not secure based on the following criteria:

• If you have the “login required” site setting enabled, all uploads will be marked as secure, and anonymous users will not be able to access it.
• If you are uploading something within a Personal Message, it will be marked as secure.
• If you are uploading something within a Topic that is inside a private Category, it will be marked as secure.

The upload on S3 will have a private ACL, so direct links to the file on S3 will throw a 403 access denied error. Any and all access to secure uploads will be via an S3 presigned URL. This will be hidden to your users though; if an upload is secure any reference to it will be made via the /secure-uploads/ Discourse URL.

Permissions and access control

The /secure-uploads/ URL will determine whether the current user is allowed to access the media and serve it if they are. When the upload is created, the post that it first appears in will be set to its “access control post” and all permissions will be based on that post.

• If you have the “login required” site setting enabled, anonymous users will always get a 404 error accessing the URL.
• If accessing media whose access control post is a Personal Message, the user must be a part of that Personal Message topic to access the media, otherwise the user will get a 403 error.
• If accessing media whose access control post is within a topic that is inside a private Category, the user must have access to that category to access the media, otherwise the user will get a 403 error.

Copying /secure-uploads/ URLs around between Posts and Topics is unwise, as different users will have different access levels within your Discourse forums. New uploads should always be created via the Composer. Oneboxes and hotlinked images will also respect the secure uploads rules. Site setting uploads, emojis, and theme uploads are unaffected by secure uploads, as they must be public.

If an access control post is deleted, the attached upload will no longer be accessible.

Moving posts with secure uploads

If you move an “access control post” between different security contexts then the upload attached can possibly be changed to secure or not secure. These are the situations which may change security for an upload:

• Changing a topic category. Will cycle through all posts in the topic and update upload security status accordingly.
• Changing a topic between being a public topic and personal message. Will do the same as above.
• Moving posts from a topic to a new or existing other topic. Will run the same as the above on the target topic.

Secure uploads in emails

Embedding secure images in emails is enabled by default. You can configure these site settings for further control:

• secure_uploads_allow_embed_images_in_emails : Disable this to redact secure images in emails.
• secure_uploads_max_email_embed_image_size_kb : The cap to the size of the secure image we will embed, defaulting to 1mb, so the email does not become too big. Max is 10mb. Works in tandem with email_total_attachment_size_limit_kb .

The secure images will be added as email attachments and embedded using the cid: url format because base64 URL support in email clients is still flaky.

If you don’t have secure_uploads_allow_embed_images_in_emails enabled, or if the images start to exceed the size limits, then this is what you will see in place of secure images (also secure audio and video which is not embedded):

Hosted Customers

At this time secure uploads is available to our enterprise customers only. Please contact us for more details.