Web

Different appwrite IDs are getting exposed in the file url.

Dec 12, 2024, 10:00

View on Discord

Votes

Replies

Participants

Unknown

Messages

bewake24Original post

Web Developer

Dec 12, 2024, 09:10

File_URL_FORMAT= https://cloud.appwrite.io/v1/storage/buckets/[BUCKET_ID]/files/[FILE_ID]/preview?project=[PROJECT_ID]

I'm trying to access files in my web app. The requested files are coming from the URL in the given format above which is exposing my projectId and Bucket id. Is this a good idea to expose them. If not how can I avoid them without using any proxy.

Summary

Developers are concerned about exposing Appwrite IDs in file URLs. A suggestion was made to use headers like `X-Appwrite-Project` instead of including IDs in the URL. However, it was noted that headers can be easily checked via Dev tools or a MITM Proxy. The File URL Format was provided as an example. Avoid exposing IDs in URLs for security reasons.

Joshi

Dec 12, 2024, 09:11

It's fine

Darshan Pandya

Dec 12, 2024, 09:50

You can use headers (X-Appwrite-Project) if you don't like the Project ID in the URL itself.
Mind you that those headers can be easily checked via just a few clicks to Dev tools > Network tab or via a MITM Proxy.

Different appwrite IDs are getting exposed in the file url.

Need support?_