# How to serve images that require authentication **URL:** \ **Category:** Rails\ **Created:** [March 29, 2008, 6:38am UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241 "2008-03-29T06:38:39Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [March 29, 2008, 6:38am UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/1 "2008-03-29T06:38:39Z")
Hi all, I have images that are part of a user profile. These images should only be served to other users that view the profile. I’m new to web apps and was wondering what would be the best way to do this in rails. I was considering putting the images in the db and serving them via a controller that would check for authentication and whether the authenticated user can view the image, then send the image. However, I’ve been reading that this may be inefficient. Any suggestions? Abhik ---
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [March 29, 2008, 10:14pm UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/2 "2008-03-29T22:14:54Z")
I hope this didn’t get lost in the sea of spam messages. ---
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [March 29, 2008, 10:34pm UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/3 "2008-03-29T22:34:17Z")
On Mar 29, 1:37 am, apramanik [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi all, > > I have images that are part of a user profile. These images should > only be served to other users that view the profile. I’m new to web > apps and was wondering what would be the best way to do this in rails. > I was considering putting the images in the db and serving them via a > controller that would check for authentication and whether the > authenticated user can view the image, then send the image. However, > I’ve been reading that this may be inefficient. Any suggestions? One option would be store the images in the file system and store a reference to them in the database. The files should not be accessible via an authenticated URL. A reasonable way to organize the directory structure if you anticipate many files is to use the current seconds, minutes, etc. in the path such as: /images/02/37/file\_one-02-37.jpg /images/07/21/file\_two-07-21.jpg With a fixed structure like this, you can get by with just storing the file name in the db since the path can be derived from that. Brian A. ---
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [March 30, 2008, 7:21pm UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/4 "2008-03-30T19:21:18Z")
Thanks for the tips! What’s the disadvantage of storing them in a DB? From what I’ve read, I’ll be pulling the actual binary data from the database, taxing the database and server. Is that the only disadvantage? I’ll be initially storing the images on the same server, so would this be any slower than using the filesystem? I’ll be using send\_file and apparently that loads the entire file into memory which would be no different than using send\_data. Thanks! ---
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [April 4, 2008, 5:49am UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/5 "2008-04-04T05:49:09Z")
using send\_file to serve images will result in huge CPU and memory demands. I suggest using x-send-file and putting the images in the file system. There’s links to the relevant software and articles at [http://www.buildingwebapps.com/topic/254-send-files-securely](http://www.buildingwebapps.com/topic/254-send-files-securely) Michael S. [www.BuildingWebApps.com](http://www.BuildingWebApps.com) ---
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [April 3, 2008, 10:05am UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/6 "2008-04-03T10:05:14Z")
If you do end up storing the images in the database, keep in mind that rail will, by default, use "SELECT \* " when retriving the data for an object. So if you just add a column to your user table that is called profile\_picture, you will be loading whatever is in that column into memory when you do something like User.find(1). If you store the image in that column, then you load the image into memory, even if you don’t need it. You could update your code to specify the select clause– User.find(1, :select =\> ‘id, name’), but you would be better off moving the image into it’s own table. You could create a model called, ProfilePicture. That model belongs\_to :user. User has\_one :profile\_picture. There are other reasons for not storing images in a database, but I am probably not the best one to explain the details. I am using send\_file (at [http://www.thoughtless.ca](http://www.thoughtless.ca)) to send images that require authtication. I have had great performance so far. However, my images are very small. Almost all of them are less than 100 kb–most are only about 10-20 kb. send\_file should not need to load the whole file into memory (http:// [ActionController::Streaming](http://api.rubyonrails.org/classes/ActionController/Streaming.html#M000228)). I haven’t tested this myself, but I have generally found that things committed to rails work as advertised. I hope that helps, Paul ---
**Author:** ![apramanik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/e9a140/32.png) [@apramanik](https://www.ruby-forum.com/u/apramanik)\ **Post date:** [April 4, 2008, 12:21pm UTC](https://www.ruby-forum.com/t/how-to-serve-images-that-require-authentication/133241/7 "2008-04-04T12:21:18Z")
Great, thanks for the tips!