On a Web site which requires user login, and all content is viewable by any registered user, is there any point in making obscure image URLs like "1mh9cr2m78234bc23-32xy4723nxy12.jpg" to protect the content from automated harvesting?

Or is this wasted effort because whoever wants to get the content will just write a spider that fakes a login and crawls the entire site, and you may just as well name your images 1.jpg, 2.jpg, ...


Most automatic crawlers don't have time to comply with the registration procedures of all Web sites. If the picture names are not "guessable" then they won't be harvested by crawlers which scan "the whole Web". However, of course, any registered user who can see the pictures will be able to slurp all of them (and not only images, all the Web pages as well). The well-known opensource tool GNU Wget has command-line flags for recursive exploration of Web pages.

Note that the server can know, by construction, who is making each request (that's what it means that a user is "logged in"). You can then implement restrictive rules such as "no more than 10 pictures per user and per minute" or similar constraints. With such rules, a user bent on downloading all your files will have to create many fake accounts, register them all, and use them more or less in parallel. You can also filter on source IP address (if too many requests come from a single IP address in a short time, ban that address temporarily).

All these deterrents are just that: ways to make the task slower and harder for attackers (if we call people who want the pictures "attackers", which is subjective). Motivated attackers will obtain them nonetheless.

Generally speaking, when you publish a piece of data, then it becomes "public" and you cannot really control where it goes. This is the dilemma of all media content providers: once the music file is out, it is out.


No, typically the reason for using seemingly-random names for images is because you want to avoid both the possibility of accidental duplicates/overwrites and also any possibility of exploitation of your service relating to the uploaded file name.

Since the file name doesn't really matter to the browser, better to just pick your own name according to your own algorithm rather than risk trouble down the road.


You may want to obscure image URLs so that they cannot be predicted. For example you cannot predict URLs of Facebook pictures because if you could you would be able to access everyone's pictures even without being their friends.

But this is apparently not your case so you do not need to obscure image URLs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.