# Publicly accessible files when uploaded via File Uploader

**URL:** <https://forum.bubble.io/t/publicly-accessible-files-when-uploaded-via-file-uploader/24270>\
**Category:** Database\
**Created:** [February 9, 2018, 10:35pm UTC](https://forum.bubble.io/t/publicly-accessible-files-when-uploaded-via-file-uploader/24270 "2018-02-09T22:35:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![manu](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/manu/32/20810_2.png) [@manu](https://forum.bubble.io/u/manu)\
**Post date:** [February 9, 2018, 10:35pm UTC](https://forum.bubble.io/t/publicly-accessible-files-when-uploaded-via-file-uploader/24270/1 "2018-02-09T22:35:26Z")

</div>

Hi

I created a simple webpage with a FileUploader plugin, which allows me to upload files.

I linked that with a simple workflow (see attached), that creates a “File” object in the database.

I then created a simple rule in the Data → Privacy section (see attached), saying only the logged-in owner should have access to that file.

The problem I have is, if I copy the URL of the uploaded file when logged in as that user, I can then publicly access that URL from any browser in private mode. In other words, there seems to be no authentication done by bubble’s servers before the file is made available, if the consumer knows the URL.

So what am I doing wrong? Or is it a flaw in bubble?

 ![37%20PM](https://us1.discourse-cdn.com/bubble/original/3X/c/8/c8a457125551a3c350a6b6fb9a7590ef2bb2bb33.png) ![00%20PM](https://us1.discourse-cdn.com/bubble/original/3X/0/a/0a1956691348fe75aef6a28696c6b7199a99e3d6.png)

Thanks.

---

<div class="post-metadata">

**Author:** ![justin.schoenfelder1](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/justin.schoenfelder1/32/74859_2.png) [@justin.schoenfelder1](https://forum.bubble.io/u/justin.schoenfelder1)\
**Post date:** [September 13, 2021, 8:49am UTC](https://forum.bubble.io/t/publicly-accessible-files-when-uploaded-via-file-uploader/24270/2 "2021-09-13T08:49:08Z")

</div>

Hi @manu Did you ever get help with this?

---

<div class="post-metadata">

**Author:** ![bryce.murray](https://avatars.discourse-cdn.com/v4/letter/b/77aa72/32.png) [@bryce.murray](https://forum.bubble.io/u/bryce.murray)\
**Post date:** [November 3, 2021, 7:26pm UTC](https://forum.bubble.io/t/publicly-accessible-files-when-uploaded-via-file-uploader/24270/3 "2021-11-03T19:26:37Z")

</div>

This is a pretty big vulnerability. Did you ever find a solution?