# Securing image / static content

**URL:** <https://www.ruby-forum.com/t/securing-image-static-content/69831>\
**Category:** Rails\
**Created:** [September 24, 2006, 7:00pm UTC](https://www.ruby-forum.com/t/securing-image-static-content/69831 "2006-09-24T19:00:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nasir\_K](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/838e76/32.png) [@Nasir\_K](https://www.ruby-forum.com/u/Nasir_K)\
**Post date:** [September 24, 2006, 7:00pm UTC](https://www.ruby-forum.com/t/securing-image-static-content/69831/1 "2006-09-24T19:00:10Z")

</div>

I have some images under /public/images/ in a RoR application. I am  
accesing  
the images from view templates using standard html ![]() tags.  
Since  
the images are under a public directory they can be accessed by anyone  
(not  
coming through my application).

What is the best way to keep my images accesible only to authorized  
users?  
I cannot keep them in a non public dir because ![]() will not work then.

Thanks

---

<div class="post-metadata">

**Author:** ![Nasir\_K](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/838e76/32.png) [@Nasir\_K](https://www.ruby-forum.com/u/Nasir_K)\
**Post date:** [September 24, 2006, 7:26pm UTC](https://www.ruby-forum.com/t/securing-image-static-content/69831/2 "2006-09-24T19:26:12Z")

</div>

Keep the images out of the public dir (say RAILS\_ROOT/assets/images)  
and then write an ImagesController that will serve up the images by  
setting the appropriate content-type and using send\_data/Ruby IO.

---

<div class="post-metadata">

**Author:** ![Nasir\_K](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/838e76/32.png) [@Nasir\_K](https://www.ruby-forum.com/u/Nasir_K)\
**Post date:** [September 24, 2006, 8:12pm UTC](https://www.ruby-forum.com/t/securing-image-static-content/69831/3 "2006-09-24T20:12:16Z")

</div>

Thanks for the response.  
Wouldnt using send\_data be inefficient as the bytes will be read in the  
server memory first?  
How can Ruby IO be used?

Thanks

On 9/24/06, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Keep the images out of the public dir (say RAILS\_ROOT/assets/images)  
> and then write an ImagesController that will serve up the images by  
> setting the appropriate content-type and using send\_data/Ruby IO.
> 
> >

–  
I don’t like $\_, actually the only place I like $s is in my wallet.

---

<div class="post-metadata">

**Author:** ![Nasir\_K](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/838e76/32.png) [@Nasir\_K](https://www.ruby-forum.com/u/Nasir_K)\
**Post date:** [September 24, 2006, 8:54pm UTC](https://www.ruby-forum.com/t/securing-image-static-content/69831/4 "2006-09-24T20:54:21Z")

</div>

Hi,

I’d add to what \*ljredpath \*suggested. Keep your images in an assets  
folder,  
but if you use Lighty, an X-Sendfile header will work wonders, as Lighty  
itself will fetch the file for you. Read more about that here:  
[http://blog.lighttpd.net/articles/2006/07/02/x-sendfile](http://blog.lighttpd.net/articles/2006/07/02/x-sendfile) (I’m waiting for  
this too:  
[mod\_proxy\_core got X-Sendfile Support - lighty's life](http://blog.lighttpd.net/articles/2006/07/22/mod_proxy_core-got-x-sendfile-support))

This is probably the most “efficient” solution.

Vish