3 ms·
Thank you for the suggestion. I'm not so familiar with this. Will this work on frontend too? If I expose the secrets on the fronted, then it's pointless. Do you
by valentinvieriu 10y ago
Thank you for the suggestion. I'm not so familiar with this. Will this work on frontend too? If I expose the secrets on the fronted, then it's pointless.
Do you have some suggestions on how to do this?
Appreciate the help! It's an important aspect and a very resource intensive process that I need to protect.
- j1436go 10y agoYour decryption/encryption secret (key) is stored on the server side only and if a client requests a thumbnail, you can validate the URL value by successfully decrypting it with this secret and probably do a simple HTTP URL validation check of the decrypted value. And you have to encrypt all thumbnail URLs with this secret before passing them to the client.
- filearts 10y agoTo the extent that you are pulling new stories directly from Firebase on the client side, encrypting (or signing) urls with a symmetric key will not work. This is because you would need to embed the secret in the front-end code which means the secret is no longer secret ;-) You could also tail the Firebase feed from a server process, generate the relevant images and only serve images for pre-existing urls.