3 ms·
We've designed our system for this very use case. Whether it's on commodity hardware or in the cloud, whether or not it's using a CDN and edge servers, there ar
by EGreg 2y ago
We've designed our system for this very use case. Whether it's on commodity hardware or in the cloud, whether or not it's using a CDN and edge servers, there are ways to "nip things in the bud", as it were, by rejecting requests without a proper signed payload.
For example, the value of session ID cookies should actually be signed with an HMAC, and checked at the edge by the CDN. Session cookies that represent a authenticated session should also look different than unauthenticated ones. The checks should all happen at the edge, at your reverse proxy, without doing any I/O or calling your "fastcgi" process manager.
But let's get to the juicy part... hosting files. Ideally, you shouldn't have "secret URLs" for files, because then they can be shared and even (gasp) hotlinked from websites. Instead, you should use features like X-Accel-Redirect in NGINX to let your app server determine access to these gated resources. Apache has similar things.
Anyway, here is a write-up which goes into much more detail:
https://community.qbix.com/t/files-and-storage/286 https://community.qbix.com/t/files-and-storage/286
- dyogenez 2y agoOhh, using the session ID in the URL would be a nice addition to this. We already generate session tokens for every user - guests and logged in users. We could pass that through to segment on rather than IP address.
- EGreg 2y agoGlad I could help… consider using the session to determine access and then just send an HTTP 403 or whatever instead of the actual images
- MassPikeMike 2y agoThanks for making me aware of X-Accel-Redirect! The write-up discusses X-Accel-Redirect's functionality in the context of qbix. For me, the two were rather hard to tease apart in that context. So for others who feel that way, I would recommend starting with Grant Horwood's introduction to X-Accel-Redirect at https://gbh.fruitbat.io/2024/05/12/nginx-serving-private-files-with-x-accel/ https://gbh.fruitbat.io/2024/05/12/nginx-serving-private-fil...