:Secure Share URL Returns Same URL + Private File Issues

Bugs
1

Problem:

The file operator, :secure share URL, returns the original, plain and unsigned URL instead of a signed one.

On a private file attached to a Thing whose “View files attached to this” rule is unchecked, the operator returns a URL identical to the file’s normal URL (no signature, no token, no expiry query parameters). I verified this by inspecting elements at runtime. If this operator is not intended to produce a shareable link, its name and the absence of documentation feel misleading.

Two related issues affecting private file access:

api_key query parameter is ignored on file routes.

GET /version-test/fileupload/<file>?api_key=<valid key> returns 401, identical to a request without it. The same URL with Authorization: Bearer <same key> succeeds. This breaks 3rd-party services that fetch a file by URL, since headers can’t be attached to an <img src>: at least one plugin today is built on the assumption that it works.

Edit: api_token works, not api_key

Private file URLs are served without CORS headers.

A logged-in user with full permission to view a file cannot read it from JavaScript: fetch fails outright, canvas marks the context tainted, and crossOrigin="use-credentials" is blocked. The browser will display the image but not let the page read it. This makes client-side embedding (e.g. converting to a data URI for PDF generation) impossible even for authorized users.

Impact:

These leave no built-in way (without plugins) to access a private file externally without making the file publicly readable through privacy rules.

2

From what I remember, it’s not api_key but api_token

3

You will not have cors issue if you use a server side plugin action.

4

:secure share URL doesn’t work in frontend element expressions, because the expectation is that you would provide access via privacy rules. It only works in workflows.

5

Oh wow, thanks, I thought I already tried that—apparently not.

I was led astray because a plugin was telling me to use api_key in the URL.

6

I don’t want to open up the privacy rules to anyone to let them access a private file attachment since that would defeat the point of a private file, so how do you securely make a private file accessible to an external service?

My specific use case is that I’m trying to download a PDF of a Bubble page that has private images on the page.

7

No, I mean that you shouldn’t ever need :secure share URL on a frontend page, because if the user has permission to see it, that permission should already be granted by privacy rules by the thing it is attached to.

If you really need it, you can use :secure share URL in a workflow and set a custom state with the result and use that or something.