If I copy the URL for a shared or private image from sites like fbcdn.net or googleusercontent.com and open it in a logged out session, the images appear.

Shouln't this return a 403 forbidden error (like Dropbox) instead of giving a malicious user access to private content?

  • The only cases that you'll be able to access the information that way is for public data. – Julie Pelletier Aug 27 '16 at 3:13

This is called capabilities-based security and it's a good option when you have highly distributed shared content.

All users that require access are given a unique URL which is equivalent to a token.

The drawback is that if the "token" is leaked unauthorized users will be allowed to access the content, but the scope can be limited by expiring the tokens, and in any case it's used for semipublic content only.

Also, for social network content like images the mechanisms by which the tokens can be leaked is the same mechanisms by which the images themselves can. The token is not guessable (or at least shouldn't be)

I believe the answer here is official by Facebook.

  • Confirmed, the Quora answer is official and is referred to in fb's bounty program terms – GnP Aug 27 '16 at 3:29
  • I wouldn't say a user's photos in Google Photos are semipublic. – simplegamer Nov 12 '16 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.