# How to control access to resourses (pictures and files) inside application? **URL:** \ **Category:** Rails\ **Created:** [February 16, 2008, 12:29pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302 "2008-02-16T12:29:36Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 16, 2008, 12:29pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/1 "2008-02-16T12:29:36Z")
I’m writing an application that will have lots of images and files that should be accessed only by authorized people. Where should I put this files inside the directory tree to avoid users typing the direct path to the file and getting it without being logged to the application? Thank you! ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 16, 2008, 5:05pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/2 "2008-02-16T17:05:40Z")
Hello, Check out my reply to another question: [http://groups.google.com/group/rubyonrails-talk/browse\_thread/thread/166febb118641065/687b918da8146023](http://groups.google.com/group/rubyonrails-talk/browse_thread/thread/166febb118641065/687b918da8146023) The idea is that you put you files outside of the public area (so no one can type the URL), then you program a header rewrite so that your web server (Apache, Nginx, .etc) serves the file after you’ve authorized that request. Since it’s a rewrite, the real name of a file can be “X23456.jpg” but served as “cassiommc\_requested\_image.jpg” Avoid sendfile if your using Mongrel to serve your Rails appplication, and plow through the above header programming above. Good luck, Jim ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 16, 2008, 5:19pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/3 "2008-02-16T17:19:57Z")
hi, ive been researching this and i found the x send file and x-accel-redirect for nginx. they can be used for downloads, however, can these be used to render images to a view? thanks for any help! JimCifarelli wrote: > Hello, > > Check out my reply to another question: > [http://groups.google.com/group/rubyonrails-talk/browse\_thread/thread/166febb118641065/687b918da8146023](http://groups.google.com/group/rubyonrails-talk/browse_thread/thread/166febb118641065/687b918da8146023) > > The idea is that you put you files outside of the public area (so no > one can type the URL), then you program a header rewrite so that your > web server (Apache, Nginx, .etc) serves the file after you’ve > authorized that request. Since it’s a rewrite, the real name of a > file can be “X23456.jpg” but served as “cassiommc\_requested\_image.jpg” > > Avoid sendfile if your using Mongrel to serve your Rails appplication, > and plow through the above header programming above. > > Good luck, > Jim ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 17, 2008, 4:16pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/4 "2008-02-17T16:16:06Z")
Thanks for your reply! but, can this work to serve the images to the view? that¶ what I’ll really nedd, I think I didn’t expressed myself well… thank you! ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 17, 2008, 9:25pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/5 "2008-02-17T21:25:31Z")
i can render the view using send\_data but its really slow and not recommended. if youfind the answer, please post back here! removed\_email\_address@domain.invalid wrote: > Thanks for your reply! > > but, can this work to serve the images to the view? that� what I’ll > really nedd, I think I didn’t expressed myself well… > > thank you! ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 18, 2008, 4:31pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/6 "2008-02-18T16:31:27Z")
JimCifarelli [2008-02-16 17:04]: > The idea is that you put you files outside of the public area (so > no one can type the URL), then you program a header rewrite so > that your web server (Apache, Nginx, .etc) serves the file after > you’ve authorized that request. > i didn’t follow the whole thread, but here’s what we’re doing > (soon): let the web server (apache) serve the content as usual and > protect it from unauthorized access with the Apache Secure Download > module [1]. it works by only allowing requests that have the correct > token, which is computed from the resources’ path, a timestamp, and > a _secret_ string that is shared between the web server and the > application providing access to the resources. so instead of putting /path/to/image.jpg into the view, you have /path/to/image.jpg?timestamp=&token=, where timestamp = 1.minute.from\_now (e.g.), and token = Digest::SHA1.hexdigest(secret + ‘/path/to/image.jpg’ + timestamp). thus only someone who knows your secret string gets access to that image. Apache Secure Download was inspired by Mongrel Secure Download [2], a mongrel handler by josh ferguson. [1] [http://prometheus.rubyforge.org/apache\_secure\_download/](http://prometheus.rubyforge.org/apache_secure_download/) [2] [http://rubyforge.org/projects/msecuredownload/](http://rubyforge.org/projects/msecuredownload/) [3] [http://prometheus.rubyforge.org/mongrel\_secure\_download-redux/](http://prometheus.rubyforge.org/mongrel_secure_download-redux/) cheers jens – Jens W., Dipl.-Bibl. (FH) prometheus - Das verteilte digitale Bildarchiv für Forschung & Lehre Kunsthistorisches Institut der Universität zu KölnAlbertus-Magnus-Platz, D-50923 KölnTel.: +49 (0)221 470-6668, E-Mail: removed\_email\_address@domain.invalid [http://www.prometheus-bildarchiv.de/](http://www.prometheus-bildarchiv.de/) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 27, 2008, 6:20pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/7 "2008-02-27T18:20:21Z")
hello Jens, Thank you for the reply, however, im still a bit confused. the web server, say apache will be the one responsible for serving images. so after i authenticate a user and check if the user has permission to view a certain view, the view action will be called with a url that contains timestamp, secret string, etc…which apache will compute to see whether or not to serve the images? What is the purpose of the timestamp? thanks Jens W. wrote: > JimCifarelli [2008-02-16 17:04]: > > > The idea is that you put you files outside of the public area (so > > no one can type the URL), then you program a header rewrite so > > that your web server (Apache, Nginx, .etc) serves the file after > > you’ve authorized that request. > > i didn’t follow the whole thread, but here’s what we’re doing > > (soon): let the web server (apache) serve the content as usual and > > protect it from unauthorized access with the Apache Secure Download > > module [1]. it works by only allowing requests that have the correct > > token, which is computed from the resources’ path, a timestamp, and > > a _secret_ string that is shared between the web server and the > > application providing access to the resources. > > so instead of putting /path/to/image.jpg into the view, you have > /path/to/image.jpg?timestamp=&token=, where > timestamp = 1.minute.from\_now (e.g.), and token = > Digest::SHA1.hexdigest(secret + ‘/path/to/image.jpg’ + timestamp). > thus only someone who knows your secret string gets access to that > image. > > Apache Secure Download was inspired by Mongrel Secure Download [2], > a mongrel handler by josh ferguson. > > [1] [http://prometheus.rubyforge.org/apache\_secure\_download/](http://prometheus.rubyforge.org/apache_secure_download/) > [2] [http://rubyforge.org/projects/msecuredownload/](http://rubyforge.org/projects/msecuredownload/) > [3] [http://prometheus.rubyforge.org/mongrel\_secure\_download-redux/](http://prometheus.rubyforge.org/mongrel_secure_download-redux/) > > cheers > jens > > – > Jens W., Dipl.-Bibl. (FH) > prometheus - Das verteilte digitale Bildarchiv f?schung & Lehre > Kunsthistorisches Institut der Universitä´ zu > K?lbertus-Magnus-Platz, D-50923 > K?el.: +49 (0)221 470-6668, E-Mail: removed\_email\_address@domain.invalid > [http://www.prometheus-bildarchiv.de/](http://www.prometheus-bildarchiv.de/) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [February 28, 2008, 8:04pm UTC](https://www.ruby-forum.com/t/how-to-control-access-to-resourses-pictures-and-files-inside-application/129302/8 "2008-02-28T20:04:48Z")
hi koloa! Koloa P. [2008-02-27 18:20]: > the web server, say apache will be the one responsible for > serving images. so after i authenticate a user and check if the > user has permission to view a certain view, the view action will > be called with a url that contains timestamp, secret string, > etc…which apache will compute to see whether or not to serve the > images? > exactly. your application generates a URL to your resource which > apache will check for validity. only then will apache serve that > resource to the user. hence, your application controls whether to > allow the user access to the resource or not. > What is the purpose of the timestamp? > the timestamp makes the URL only valid for a certain time. if the > user saves the previously received URL to get access to the resource > again at a later time, the timestamp prevents a successful “stealing”. i suggest you just try Apache Secure Download [1] and see if it suits your needs 😉 if i can help you make it work, just let me know. (it’s available as a gem from rubyforge – sudo gem install apache\_secure\_download) [1] [http://prometheus.rubyforge.org/apache\_secure\_download/](http://prometheus.rubyforge.org/apache_secure_download/) cheers jens – Jens W., Dipl.-Bibl. (FH) prometheus - Das verteilte digitale Bildarchiv für Forschung & Lehre Kunsthistorisches Institut der Universität zu KölnAlbertus-Magnus-Platz, D-50923 KölnTel.: +49 (0)221 470-6668, E-Mail: removed\_email\_address@domain.invalid [http://www.prometheus-bildarchiv.de/](http://www.prometheus-bildarchiv.de/)