# Attachment foo - files security

**URL:** <https://www.ruby-forum.com/t/attachment-foo-files-security/165688>\
**Category:** Rails\
**Created:** [April 16, 2009, 1:28pm UTC](https://www.ruby-forum.com/t/attachment-foo-files-security/165688 "2009-04-16T13:28:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zirael](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/91b2a8/32.png) [@Zirael](https://www.ruby-forum.com/u/Zirael)\
**Post date:** [April 16, 2009, 1:28pm UTC](https://www.ruby-forum.com/t/attachment-foo-files-security/165688/1 "2009-04-16T13:28:35Z")

</div>

Hi,

I am using attachment\_foo for sharing files between users. Everything  
works fine but I am worry about the security.

All files are stored in the public rails folder so any browser can  
easily access these files!!  
I know that the folder path is specific but probably I could write a  
simple script that could find some common file names.

Guys, did you think about that during development?

Is there any way to serve files by rails app. So that I could avoid  
storing files in public directory?

Is database good idea? Is it efficient way?

Thank you.

---

<div class="post-metadata">

**Author:** ![Zirael](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/91b2a8/32.png) [@Zirael](https://www.ruby-forum.com/u/Zirael)\
**Post date:** [April 16, 2009, 1:39pm UTC](https://www.ruby-forum.com/t/attachment-foo-files-security/165688/2 "2009-04-16T13:39:44Z")

</div>

On 16 Apr 2009, at 12:27, Zirael wrote:

> Guys, did you think about that during development?

Use X-sendfile, X-Accel-redirect or generate hard to guess filenames  
(ie /1ea39e7eacd783eda093223aebdcdf234/myfile)

Fred

---

<div class="post-metadata">

**Author:** ![Zirael](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/91b2a8/32.png) [@Zirael](https://www.ruby-forum.com/u/Zirael)\
**Post date:** [April 16, 2009, 2:03pm UTC](https://www.ruby-forum.com/t/attachment-foo-files-security/165688/3 "2009-04-16T14:03:31Z")

</div>

I had the same problem with some of my projects, where some images or  
files had to be accessible only to logged users.

The solution is easy (I’m using file\_column but the idea is the same),  
when you declare has\_attachment you can also select where to save your  
files using :path\_prefix .

You can set something like :path\_prefix =\> “resources/#{table\_name}” or  
some other non public directory to avoid accessing the files directly by  
passing a url.

To access the files, you call a method in a controller that serves back  
the file using the send\_file function. Check the api for better info  
about it, you can send back the file inline (to be used in an image\_tag  
for instance) or as a download.

Since the file is sent by a method, it’s easy to prevent its download  
from non authorized user