0

In my project, I am using headless Drupal with .Net on the front end.

I have to use encrypted file system for the project requirements. I am encrypting the files and then decrypting using oauth token and storing them in public folder so that .Net application can get the file as API response. But the problem starts here. As these files are in public folder, if a user logs in to the site and then copies this url and pastes that in another browser, he can easily view that file. But this is not the desired requirement and it creates a major security breach. So my question is how can we restrict public files from getting accessed by anonymous users?

Improve this question
1
  • how can we restrict public files from getting accessed by anonymous users? You can't, not at the Drupal end anyway. Standard web server setup for Drupal will serve static files if they exist, and bypass Drupal (for obvious performance reasons). Drupal has the private file system for exactly this use case, but you'll need to authenticate the requests from your front end to Drupal, in order to use it. You can easily do this by logging on via the REST endpoint, and using the session/token information you receive from that for subsequent requests.
    – Clive ♦
    Oct 19, 2021 at 10:21

1 Answer 1

Reset to default
1

Drupal provides a private file system mode for files ( https://www.drupal.org/docs/8/core/modules/file/overview#s-managing-file-locations-and-access ) that allows restricting access via hook_file_download ( https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21File%21file.api.php/function/hook_file_download/8.9.x )

If you can’t use private file system mode for storage then you’ll need to restrict access in your web server, such as nginx.

Improve this answer
2
  • I tried with private file systems also, but am not able to get the response from .Net end as the files are private. Is there any way to get these files as response from .Net end? For more insights, refer to this link once- "drupal.stackexchange.com/questions/307514/…"
    – Jewel Chakraborty
    Oct 19, 2021 at 7:54
  • I have already tried to restrict access in web server, but in that case also, i must bypass that authentication from .Net end to get API responses. Again, i will have to send username and password appended with url to bypass this server level authentication. Hacker can get that username password by inspecting the website which again leads to security breach.
    – Jewel Chakraborty
    Oct 19, 2021 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.