Self HostedWeb

Storage file url

Mar 24, 2024, 08:00

View on Discord

Votes

Replies

Participants

Unknown

Messages

BeTOriginal post

Rank 1: Thread

Mar 24, 2024, 07:15

There was an image in the storage bucket that was pushed to production as a link like this
https://ENDPOINT_URL/v1/storage/buckets/BUCKET_ID/files/FILE_ID/view?project=PROJECT_ID
does it mean that project was compromised and in theory anybody can access to it with sdk?

Summary

Developers, check permissions settings in Appwrite Console for file access. File security can be enabled there as well. Ensure proper permissions are set for read access. The image URL provided does not compromise the project if permissions are set correctly.

Meldiron

Mar 24, 2024, 07:59

Hi 👋 View, preview and download endpoints for files all respect permissions. You can open Appwrite Console and check settings of your bucket. Whoever has read permissions was possibly allowed to see the file.

If you have file security enabled, also please view details of a file in Appwrite Console and check permissions there. Those with read permissions on file could aslo possibly read the file

Storage file url

Need support?_