Back

Audit for Storage

  • 0
  • Storage
سيادة اللواء حناكة
18 Jul, 2023, 01:58

I always wanted to know the requests that had been sent to my Storage to know who could access the download API as my security purposes don't allow to access this API , And I hidded the endpoints as much as I could but by somehow a user who had access to read a storage bucket could know my the file ID and did the download API "Content download" I only do "View" in my Flutter App .

My Question is , is there a way to know which user downloads the file , by function maybe or anyway to register the Download API Requests manually as Audit logs don't give accurete resulsts about Storage Buckets . " all my buckets are protected by premissions of appwrite no public or "any" buckets , + only Anrdoid/Ios apps used with appwrite , no web which protected hardly by SSL Pinning with custom SSL so if someone find a way to get the File ID I want to know him by registering all Download API requests but I don't know how to do it correctly or from where to start simply as I can't modify or edit the open source Appwrite to do that . is there a more simple way to register all "Download API" Requests with the user ID or something with functions and events maybe , but I am not sure that events supports the requests that download the files?

TL;DR
The user wants to know if there is a way to track and register the download API requests in Appwrite's storage for security purposes. They have considered using a 3rd party tool or capturing network traffic, but are unsure of the best approach. They also mention that the current audit logs don't provide accurate results for storage buckets. The solution suggested is to put a tool in front of Appwrite to capture network traffic and analyze cookies to determine the user. They also mention the possibility of using functions and events, but are unsure if it supports download requests. There is no definite solution provided in the thread.
Drake
18 Jul, 2023, 02:48

Appwrite doesn't track that stuff nor does it fire an event for read.

You tightened to put something in front of Appwrite to capture all of the network traffic. Then, you can grab the cookie and figure out the user

سيادة اللواء حناكة
18 Jul, 2023, 15:22

any recommendations for 3rd party tool can do such thing ?

Drake
18 Jul, 2023, 17:31

no sorry

Reply

Reply to this thread by joining our Discord

Reply on Discord

Need support?

Join our Discord

Get community support by joining our Discord server.

Join Discord

Get premium support

Join Appwrite Pro and get email support from our team.

Learn more