1

Here is what I want to do: We create reports for customers, normally we send them as pdf to our customer who then shares them with colleagues across his company. We want to switch now to digital reports.

  • The report is accessible only via URL with UUID
  • When the user clicks on the link, he is redirected from https://example.com/uuid/ to https://example.com/customer/report/
  • The second domain checks the http referer for the UUID. We make this redirection to prevent the problem when the user clicks in the report on an external link that the other server has the UUID in their referers logs.
  • We create the UUID v4 with the NPM Package UUID
  • Everything is via https connections

My questions:

(edited to avoid duplicates)

  • Can crawlers find the UUID if it isn't posted anywhere?
  • Is my solution to redirect to separate report page to avoid the problem with UUIDs being exposed in the request URL effective?

Why don't we use username / password? Simply because at the end with sharing the report these credentials are shared in emails as well. And either we make a long secure password or the client makes it but then there is a good chance that he has to share one of his standard passwords.

3

It's not very safe, but depending on how sensitive the file actually is, you may consider the risks worth the usability benefits.

Can a robot index such pages and their UUIDs?

Yes, if someone posted the link to the file on the public internet, then they can be indexed. With major search engines, you can ask search engines to exclude this directory by using robots.txt, but compliance with robots.txt are voluntary and there are many other spiders that ignore robots.txt.


If you want to secure this without losing much of the usability, you may want to consider requiring viewers to create individual accounts to access your site. The viewers should enter their email, and you'd validate their address by sending an email with a confirmation token, you'd then send a message to the document owner to ask them to grant access to the user identified by their email. Additionally, you may want to allow the document owner to specify a list of email domains and addresses that will be automatically granted access, so that he wouldn't have to manually grant every requests. Most companies give their employees email addresses on a company domain, so this would cover a lot of use cases. This way, each user that accesses the document will still be identified, rather than being an anonymous user.

If you really don't want to require users to create an account, it is possible to implement this without requiring user password, when user type their email, they'll be sent an email which contains a link they'll click that have a unique token that grants them access to the document for a short period of time. When the short term token expires, the user can request a new token.

  • Thx but only if they post it they can't crawl it right? – urban-a Nov 1 '17 at 15:38
  • And yes individual user accounts are possible but much more effort. Because now they just forward the PDF – urban-a Nov 1 '17 at 15:39
  • As far I see it: it is save with the correct uuid (not lseude random etc) as long it is not shared but that also applied for password. But my concerns are: can crawler crawl it just because it's a part of an Url – urban-a Nov 1 '17 at 15:42
  • My Conslusion would be: It is as secure if I would generate one password and user for all and share this credentials with the customer. Individuals accounts aren't possible because we don't know who is allowed to create an account. And so they would have to inform us upfront who emails are allowed and that means they can't share the report as they want – urban-a Nov 1 '17 at 15:57
  • @Thomas Urban: Actually, even adding a shared password is slightly more secure. It allows users to link/reference the file without giving access to everyone who can read the article where they share the link. As an analogy, it's often still useful to be able to link to paywalled scientific papers and talk about parts of its content even if not all of your audience actually have access to the paper. – Lie Ryan Nov 1 '17 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.