0

My users upload their profile images and I save them in a public folder. The file names are not predictable (they are based on md5 hash of user id with salt). When someone views the user's profile, I embed a link to the user's image.

I'm worried that someone may download the entire directory and misuse the images. How can I protect against this? Specifically:

  • Are wget and curl the only realistic options for such an attack?
  • I realise that wget respects robots.txt, but can I rely on this?
  • Does curl respect robots.txt?

UPDATE: I'm using a ubuntu server

Improve this question

1 Answer 1

Reset to default
0

The file names are not predictable (they are based on md5 hash of user id with salt). When someone views the user's profile, I embed a link to the user's image.

Let me translate this: Everyone who knows how to get the profile page knows the URL of the image.

I realise that wget respects robots.txt, but can I rely on this?

No.

Generally - you can only rely on this type of security if the obscurity is absolute. Anyone accessing a page linking to the picture can get the picture.

Anyonene can try guessing names, but that you can easily block.... or just use long enugh random keys to make it very rare to get a hit.

Improve this answer
2
  • TomTom, I'm worried about people downloading the entire directory. I'm not worried about people downloading individual files.
    – DatsunBing
    Feb 11, 2014 at 7:50
  • No difference. If I can access the profiles then I can download all files. Same mechanism.
    – TomTom
    Feb 11, 2014 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .