I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions:
- anyone in the world can enumerate and read the files
- anyone in the world can read the files (knowing their names in advance or guessing the names)
- a valid access token is required to read a file
Those access tokens are generated using a procedure that is only available to registered, logged in and authorized users only - those can cause a token generation and get a link (with an access token) that they can send or publish to anyone and then anyone can use that link to access an individual file for some period of time and after that time the token expires and those random people can longer access the file unless they obtain a new link with a fresh token.
The anomaly I see is that when a "folder" has "anyone can read the files" permission set then anyone can access any file using an URL like
but if he uses a link with an expired token like
then he cannot access the file. This doesn't make much sense, does it? If I can open the door without a key it means the key doesn't matter so I can just as well use any key.
Are there any use cases in which the model described above (access granted without key but denied with a wrong key) does make sense?