# Securing file upload - Need Help! **URL:** \ **Category:** Need help\ **Created:** [May 25, 2023, 7:35pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459 "2023-05-25T19:35:04Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 7:35pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/1 "2023-05-25T19:35:04Z")
Hi, I am trying to secure file uploads from users. Here are my upload settings: ![Screenshot 2023-05-25 at 2.30.58 PM](https://us1.discourse-cdn.com/bubble/original/3X/5/9/5930781cc58985653f5fc33899d5f1425d283e15.png) Here are my privacy settings: ![Screenshot 2023-05-25 at 2.31.11 PM](https://us1.discourse-cdn.com/bubble/original/3X/5/8/584f7fe6a9d9e72f87921827ae3e63625430670d.png) But still, when someone has the CDN URL (i.e. [https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685042659128x838821363675895200/Screenshot%202023-05-25%20at%202.23.49%20PM.png?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685043388&Signature=EFnnTLA2gd4AMmqqtPEP0GnGmzA%3D](https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685042659128x838821363675895200/Screenshot%202023-05-25%20at%202.23.49%20PM.png?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685043388&Signature=EFnnTLA2gd4AMmqqtPEP0GnGmzA%3D)) Anyone with the URL can view the source file. How do I secure the files so only the members of the team can view it or see the attached file? Thanks! ---
**Author:** ![artemzheg](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/artemzheg/32/9651_2.png) [@artemzheg](https://forum.bubble.io/u/artemzheg)\ **Post date:** [May 25, 2023, 7:52pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/2 "2023-05-25T19:52:28Z")
> [@hcassin](#): > > Anyone with the URL can view the source file. Right now when I open your URL I get: `AccessDenied` `Request has expired` Are you sure anyone can access the source file? ---
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 7:59pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/3 "2023-05-25T19:59:32Z")
Thanks for the reply! For that file now I am getting it. But I’m testing in duckduckgo pasting in the URL and for two others I just uploaded I can still view (logged in in chrome) i.e. [https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685044907936x677448095132356100/sample.pdf?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685045212&Signature=sB4fIGQ1ab0hJ8TEyH4wsvVeyv8%3D](https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685044907936x677448095132356100/sample.pdf?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685045212&Signature=sB4fIGQ1ab0hJ8TEyH4wsvVeyv8%3D) ![Screenshot 2023-05-25 at 3.01.57 PM](https://us1.discourse-cdn.com/bubble/original/3X/7/3/7306726142fdae88553c3728608b41e24bff566d.png) ---
**Author:** ![artemzheg](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/artemzheg/32/9651_2.png) [@artemzheg](https://forum.bubble.io/u/artemzheg)\ **Post date:** [May 25, 2023, 8:03pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/4 "2023-05-25T20:03:27Z")
yep, I can access this pdf using your URL. Are you testing file upload process using an existing user connected to a team? or was it a temporary (not logged in) user? ---
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 8:04pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/5 "2023-05-25T20:04:29Z")
Super weird right? I’m testing as an existing user connected to a team. ---
**Author:** ![artemzheg](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/artemzheg/32/9651_2.png) [@artemzheg](https://forum.bubble.io/u/artemzheg)\ **Post date:** [May 25, 2023, 8:06pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/6 "2023-05-25T20:06:00Z")
Within what data type have you created the privacy rule - User or Team? ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [May 25, 2023, 8:10pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/7 "2023-05-25T20:10:43Z")
These are presigned URLs, meaning that specific link expires in a certain amount of time and is public, but it took someone private that has access to be able to generate that link in the first place. Try clicking that previous link now, it says it has expired. If you try to view the file again from inside your app/editor you’ll notice the link it different, it generated a new one that will expire soon too. Perhaps what you’re chasing is a S3 bucket policy that only lets someone view it if they are being referred from your app’s domain (they clicked a link from your app only), that would require your own S3 bucket and you would upload directly to it (plugin required) ---
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 8:14pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/8 "2023-05-25T20:14:06Z")
Thank you! From what I understand the files are completely private until someone (with permission) opens them. Then a unique URL is created with a time limit (anyone know what that is?) So the URL above is now not accessible, but I opened (as a user with permission) the same file again and a new URL was generated that is slightly different. Below are the two URLs for the same file: 1. [https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685044907936x677448095132356100/sample.pdf?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685045212&Signature=sB4fIGQ1ab0hJ8TEyH4wsvVeyv8%3D](https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685044907936x677448095132356100/sample.pdf?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685045212&Signature=sB4fIGQ1ab0hJ8TEyH4wsvVeyv8%3D) 2. [https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685044907936x677448095132356100/sample.pdf?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685045711&Signature=fXTYAsfnmLRmnYu66NuyoC6FrvM%3D](https://8cfc205a92a7bc2ee3ca59fc24732ee2.cdn.bubble.io/f1685044907936x677448095132356100/sample.pdf?AWSAccessKeyId=AKIATBBF73RNGVJNFEZN&Expires=1685045711&Signature=fXTYAsfnmLRmnYu66NuyoC6FrvM%3D) Thanks for the help, and I hope this helps someone else! ---
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 8:27pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/9 "2023-05-25T20:27:58Z")
Looks like the links timed for 10 minutes and then go dead. ---
**Author:** ![artemzheg](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/artemzheg/32/9651_2.png) [@artemzheg](https://forum.bubble.io/u/artemzheg)\ **Post date:** [May 25, 2023, 9:16pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/10 "2023-05-25T21:16:09Z")
> [@tylerboodman](#): > > These are presigned URLs, meaning that specific link expires in a certain amount of time and is public, but it took someone private that has access to be able to generate that link in the first place. So, technically it’s not 100% private, cause authorised app user can share presigned URL with another user (who is not authorised to have an access to the file) and this unauthorized user will be able to get the file before the link expires? ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [May 25, 2023, 9:26pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/11 "2023-05-25T21:26:33Z")
The file is considered private because it takes a authorized user to generate a unique link to the file for a short time. You are correct someone could share the URL in that 10 minutes and someone else could see it. But if they are leaking documents why are they an authorized user in the first place? 🙂 I use external Wasabi S3 storage, and I have a bucket policy where they can only view the file it they clicked the URL from within my app (called an HttpReferrer). Maybe that’s what you might want? So a user clicks a link inside the app and view the file. If if they copy/pasted the link to their browser it does not work. I’m not really a cybersecurity expert but I think Presigned URLs are still considered more secure, I think HttpReferrers can be spoofed if someone really was tech savvy. ---
**Author:** ![artemzheg](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/artemzheg/32/9651_2.png) [@artemzheg](https://forum.bubble.io/u/artemzheg)\ **Post date:** [May 25, 2023, 9:50pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/12 "2023-05-25T21:50:05Z")
> [@tylerboodman](#): > > You are correct someone could share the URL in that 10 minutes and someone else could see it. Just checked Amazon’s docs on presigned URLs: > **Anyone who receives the presigned URL can then access the object**. For example, if you have a video in your bucket and both the bucket and the object are private, you can share the video with others by generating a presigned URL. Because presigned URLs **grant access to your Amazon S3 buckets to whoever has the URL** , we recommend that you protect them appropriately So I supposed that “private” files are really “private” in Bubble because only authorised users can access’em. But it turned out that is not quite true. Thanks for this great insight, haven’t seen this on the forum before. > [@tylerboodman](#): > > But if they are leaking documents why are they an authorized user in the first place? 🙂 Secret agent making dirty stuff being an official employee 😀 Or some computer virus triggering a script to send links to scammers in the background. > [@tylerboodman](#): > > Maybe that’s what you might want? So a user clicks a link inside the app and view the file. If if they copy/pasted the link to their browser it does not work. Yep, I’ve been thinking about some similar to Google’s sharing concept. So to get an access to some file user has to log in Google’s account and then Google checks if this user’s email is whitelisted. From my POV (not a cybersecurity expert an any means) such approach is more secure than using presigned URL. ---
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 10:17pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/13 "2023-05-25T22:17:31Z")
> [@tylerboodman](#): > > I use external Wasabi S3 storage, and I have a bucket policy where they can only view the file it they clicked the URL from within my app (called an HttpReferrer). Could you explain a little more about how I could implement something like this in my app? It sounds like a great solution. 😀 ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [May 25, 2023, 11:37pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/14 "2023-05-25T23:37:21Z")
> [@artemzheg](#): > > Google’s sharing concept. Funny you mention that, when I view a picture from my Google Drive, [Here is the image link from the dev console](https://lh3.googleusercontent.com/fife/APg5EOb1ywbfk6eT0wDKOygXGtnH9zxo4QLkyhBoVJX8p5MMgg2mpvt3xYF3WSpB3JwqJ8H4SxxpLyWA9fB26V7vrblMUDWq-rNOzjuyDbkBoXEzN3VZ7stXKDQLsSQa2CanpNx5GuCciefDUJ6w8zmTmtRTJOl3juAUryKU9lFMN2GzYa9tdveNlbChMmGXF-ctNkJzoklzooJzzfT6O5nmSpnJBbdQbpaSPffV07AjxbibLBVvkvEReG6h7BuJLB2oALjB4GRc7C5TgiEpvl8adj_3HbvDoM3H0vEsEA_4QvVCt8NKrbjVCzy_qOZ1pmdrbyqX8nEQsBgXTKgOG55UMrmw3GOM-waHdVDXY_Q7mw7eym1-v2-2naG7PQGn_olFdQaNXZxGEBaGnS5IST2yMqDMjLBtVktduATWhMLFShxUIqIP0BO1fe8EjY8OJrpK1NEY2UxDf6o1gJMSGNM4_o0QmrLqv4rVX8oRGYtqWVxeIb9dLSo_xUeuW5NoQHnvgJmraAtIBS5a99ctFc8nulqmI-ROHS4130ZA0wISQz6HH8yfOjl5WklErJTIs67d7McYzOvTwtwqtlvV_kAgzqr6xye_DvcHMHNqgoDZcAOftDzQ9ZxjlqfFiKetUlLc3Yx2phS-zfGvy0s-1c7aaesLCc0exK7L0nAYGseNH_ZDfyLam_chVAcyGH00mRNAUzHwgCQtMjchWGT0SindkIoANqv_fCsulp5VX5XZ2zAdYjC_6ZAFj-ys_OLAoWzG1WoKcZYiz_kWztffzLfZBRyjLDMbDyeRfPo827m1kJBSN5w89doDJIMJ1BIQHz97c4EyYOhplE_wa-DsR1wbdiUj4mgPKPv71ky2uSwauMtNt-23Pp5-OtyBVpCVOHbRQEwBUKI-K1g3g8kKnXef38QbMp7vWlGspdhO-dy0HvLJbOVjo-FUDEyI0iT-dasbLTipjLyZPxyyvnmlO_CWH-ox9wu3_uHuEjvPwMk5SfbcxdJoLpNumSqvDgu9gIv2LyLiwdGV2WTc6fINeLKi1uu-QIpCRtc-gqHXl2xxFP-tsCRFlLb7W-WP7MhnTXRnC8d5LkDmp6UOzlf4cRvCnaMTMngHCpdGceUDxZccT5tGuYBjXIZRVNTYFw4OHPSvuXyUvdWsHScYnrJWL9KTpfokwGREfxa25SO0vGg0GWz5V8urpISfCS_5U-L0TWPNN_oymgxL_s-zIAQIRnlUcBdJx69x-rIsrxMxl4JACGG5riuLBW5I-PPpbgWXm3GOFpH8xk9pa-cwyLFDqtZuIjOagxZEbA-Aa4dQxLkOhZlWSaFR2pzAsE0v8HerncG6q0IXeFuUWXBUA1JV8ZReIgZ9sI3zcNBx-lFUFdsjBBUC2O5UmYiy3Ud1GyG5UmpJi382AcA_BCEkn4lF1sSMG2LCJOkSlUW2JSsdJeMiaFt4Uu8b4N1mWsVGbnJ9-YYbfn9rPWCbySD7GQKvJEzLOJtclQ9ovDnUkhKI-_DgW00OCeutluDO2o1LEMQn3X4z27YtDOGtYZifN97lrvJrm-WAgis4h2zxwIw5GaaAWppMkSKxgjzqgi3gD8QN6no4tqJIJW2mOCveyuTIR97Ra6rATEwz_GYfrzQyb7J8jzU=w2483-h1608) [And here is the same picture but I uploaded through Google Photos](https://lh3.googleusercontent.com/T_1Ndr7EwMxwvNsOMm1jQ06xZuPRIYJO0p7vromC3fCnc8eTG5H0nimH3dJzusaR8baDbG_EVOtT5LlkAWRUuQi76zzfBrB5gGZpursu4U75sU3MVlFsfrBZiHAjEnruA5CgGWYDo4a-TA7_-JduRqm45FU0oQpM_M3rTHxjNqgAiaqJxZhDfTXkEWIz4WXj7s_iFcZgutaFEj8CIeh0ISM2EO69a4M8wZ77IrOviJ9KS8SjSSXMC8pxyVHJ77S2TqtQeT27zhQvfe2RqWTi0BvMfX33M_9y0qiNf7Ug2UUTbrsY5nqxendR2OY7tZD1boTEhdRaNNXIUnLrdcD2MpOXG6wLoUOwM3hHDmxMrogtokNOuBqU2IUFrVjRLrNDpE4RNXSfSF577c02qnBUVDfgOwNCXeyN9rowse_Ric4tbBC1lv7Bw9h_FakQqZMxZu50jvR3w5dNBFVUPkNT1HdD-v5ZltZXZWgbzPEyp2MLnfDaZa8b7QBigHaeNDYTrb67U4kFmYogQ7y9WmSO8e1M9tJ45b1AcD-2_-9oxj5aCe-64jAmatRUiA_DB-K4py6smJTOhuzS_cKKaiuLqHWZqR9oXB5N8ZcO0GesRlAFCK939shJjGPj0wN85n_kXuuN0Wj2hQ4OOvMAxWLI-N0MbyThL1kTzLQmPbuqYbf2LoJnys7abgDNNtnqbfkY5uJgfqhFbYeMpeu4ktr9QPBRVRen6UVsVKnWIg9riGI2COEQEZTe9-3UZ_NGsAEi3RL5wFeDa9oCT9-wzoEILFrNMG7VfDRzM6tmIN8TkusW2XOPL2UmbyFOskoE5q23l6gZSfXJm97XI3wSGQCcq7GoziUP6TqmpnIZfNCPWOiBkVPVjB1ZRKQwXctcLDpXY5TrSt77nE8ydJS-WDgw7HMSLtPcNiTdNDNSUr3FsVnh9k7YJlrL9KLYxqNOXtx1msmeaBahqyL3SedIhgb6vAWNdsgP1sEL0GYow6j6ayYXYKD78wD42Dfw18mRCN3PNHYEHabgZsQp70hFIEDpc0nEU-Lw_j7uvGVzj6Ndel450-FMeADO_kl_Pfe5Ew=w1853-h928-s-no?authuser=2) Neither of these I shared with anyone (the link it would generate to share would be a much shorter link to Photos, not a direct image URL), I just viewed privately from my Google account, are you able to see these? I tried the URLs in Incognito and a different browser and they work Everytime I refresh in my Drive or Photos, those URLs change… almost like a presigned URL 🤔 😂 According to [this answer](https://webapps.stackexchange.com/questions/92777/how-to-get-the-direct-link-to-an-image-in-my-google-photos) googleusercontent images expire after 1-2 days So far it seems when someone shares a photo with you on Google Drive you’re just given permission to generate a signed URL for you to view (Similar how you would do it in Bubble) I think no one is using the HTTP Referrer method because it’s considered [easily spoofable if someone really wanted to](https://www.google.com/search?q=can+http+referer+be+spoofed). Even if it is a cool concept of “verifying where they came from” ---
**Author:** ![hcassin](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hcassin](https://forum.bubble.io/u/hcassin)\ **Post date:** [May 25, 2023, 11:50pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/15 "2023-05-25T23:50:35Z")
Yeah I can see the image from both the URLs… this is really interesting. ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [May 25, 2023, 11:56pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/16 "2023-05-25T23:56:06Z")
This can be done with your own AWS S3 bucket but I just chose Wasabi S3 instead. I can find the links tp the plugins to integrate with those storage providers if you want It comes with its own pros and cons, like it being less integrated than Bubble’s file storage, but you get your own private bucket to change access like I mentioned before. But certain things like other plugins uploading files (Webcam capture, PDF generating plugins, etc) will still want to upload to your Bubble storage. So another plugin would be needed to transfer the files out of your Bubble storage and into your AWS S3 If it’s just users uploading/downloading then the plugins would be completely fine though. The HTTP Referrer thing is nice, it just depends on your level of security needed. Clearly wasn’t good for Google since they do the Signed URL route I should also mention you can do your own bucket and also just do Signed URLs ---
**Author:** ![system](https://us1.discourse-cdn.com/bubble/original/3X/2/8/2847faa74692c2ffa5d939d3dc3724cdd060d247.png) [@system](https://forum.bubble.io/u/system)\ **Post date:** [August 3, 2023, 7:35pm UTC](https://forum.bubble.io/t/securing-file-upload-need-help/264459/18 "2023-08-03T19:35:59Z")
This topic was automatically closed after 70 days. New replies are no longer allowed.