3

I'm developing a business web application for my client, in which he can upload images (e.g. floor plans, photos of object etc.) and documents of different objects (word, excel etc.). The images should be displayed when someone logs in the website and selects an object.

I'm using the Google Cloud Storage platform as the file storage and I made the bucket in what I'm storing the images available to the public Internet. The url is something like this:

https://storage.googleapis.com/mitulat-bati-bucket/{guid}.jpg (every file has a guid as the name)

So it's only available if one knows the full URL including the GUID (the filename).

My question is: is it safe enough and can go forward with this approach? And is there any potential hazard apart from guessing out the guid?

(the other approach would be to initiate a request from the client to my backend server that downloads the file from the cloud (with authentication) and sends back the image to the client that displays it)

Improve this question
3
  • How big of a deal is it if the files can be viewed by someone who is not supposed to?
    – multithr3at3d
    Commented Jul 4, 2020 at 18:48
  • There are images with different "deal levels". From huge to negligible ones.
    – Mitulát báti
    Commented Jul 4, 2020 at 19:08
  • @multithr3at3d So do you recommend that for confidential files I should go with the second option and other files can be fetched from a public repository?
    – Mitulát báti
    Commented Jul 6, 2020 at 15:54

1 Answer 1

Reset to default
3

Your security is based upon an attacker not knowing the GUID of your files. Let's evaluate how "secure" that is:

  1. Bruteforce is an option (although for a GUID, it is probably not very realistic)
  2. Anyone with access to the app can easily see the full URL and share it. If someone using the app took a URL for a sensitive image and, for instance, posted it on Facebook, you would have no way of stopping them from sharing it like that.
  3. If the bucket itself is also public then anyone who knows the bucket name (that isn't the real bucket name in your question, is it?) can ask google to simply list the bucket contents, and GCP will happily give away every single filename.

Is there a security risk here? I would say there absolutely is. Are these security risks deal breakers for you and your system? Only you can answer that.

The other-other solution would be to use signed URLs, which effectively generate a temporary and short lived URL that the end-client can use to download specific objects from the bucket even while it is private. This way you can make your bucket and objects private while still allowing authorized users to download objects without having to pass them through your own server. Building a signed URL doesn't require any API calls to GCP, so it rarely creates issues with performance/response times.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .