How to prevent unauthorized users from accessing an image on my server just by URL?

Question

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I prevent people from accessing the same image just by using the URL (if they find it out)?

I could use a PHP script which requires a token to serve the image (rather than access it directly). But If someone goes and reverse engineers the mobile app, token can also be found. I could try and hide it really well, but isn't there any other, better solution?

Answer 1

You have to work with that images the same as it should be for restricted content. There are two major points:

1. Protect access to the content (the images)
2. Protect content against brute force not to allow user guess about image path.

The both points could be covered with proxy request through php script. The first point can be solved with authentication and protection content with a token and ACL (access control level). Make sure the images out of webserver visibility not to access image directly. It could be helpful to rename image after upload and save original name and new name in DB. In this case you can call it from app by original name and access it by new unique real name.

Answer 2

An answer for the question title: just require a login and password and check the user's authorization before sending the image.

An answer for the question body/comments: as mentioned by ChatterOne in the comments, as long as there is a free access to the app, there is no way to prevent the download by a determined person.

Basically, selling/providing the raw data is not the way to go. Selling a service is. As long as you are keeping your app as is, it will leak the data sooner or later. As long as you are constantly evolving, offering more analytics based on the data, more services, more customer satisfaction - data leeches will be always left behind.

Answer 3

Here are some ideas.

1. Everything has to be SSL TLS v1.2+
2. Having a login/password would be best
3. Having succeed in logging the user gets a code random 64 bytes or more
4. The request is modified so instead of https://www.etc.com/file you have https://www.etc.com/random 64 bytes or more/file
5. The code expires either when the user logs out or time based
6. Time base is more secure, and the app can fetch a new code every say 5 minutes
7. Each code is internal tied to an IP address, and the user has to re-login if it changes.
8. Any IP submitting false 64 bit token is banned. say 20 minutes.

If they MITM the SSL cert and packet dumped the traffic it might still be possible, but the bar is raised significantly. Certificate signing and pinning make this incredible difficult.

This way no fixed code is stored in the app. The user has to pass through a user/password check to even get said code. Even if you publish the source code a valid user name and password will still not be present.

Each user and if multiple logins per user are allowed each instance has a different key. If they have a cell phone and a tablet.

Without a username/password any process can be reverse engineered. The 64 bit token can't be easily guessed, but the process of getting one could eventually be guessed.

PHP has a "session id", and you could symlink the session id to the real folder internally. Deleting said folder after 5 minutes or etc. Probably better to use a secure random function.