Images in the private mode can still be accessed when not logged in

[zhenruyan]

私有状态下图片仍然可以在非登录状态下访问。
设置成必须登录才能查看后，图片仍然可以直接访问。

[fenbox]

这里带来一个问题，如果图片存在第三方 OSS，该如何验证权限呢？

Here is a question: how to verify the permission of images if they are stored in OSS (Object Storage Service)?

[zhenruyan]

参考minio和七牛云又拍云等的方案，通常是向oss服务申请一个key ，再通过303重定向到真实的带着key的资源链接实现的。
但这会带来一系列的问题，比如问题内容发布修改时的逻辑。 以及图片资源需要归档到数据库等。
具体参考文档 https://help.upyun.com/knowledge-base/cdn-token-limite/
（通常客户端会这么干 ，不知道老哥有没有什么骚操作）

Referring to solutions such as Minio and Qiniuyun Youpaiyun, it is usually achieved by applying for a key from the OSS service and redirecting it to a real resource link with the key through 303.

But this will bring a series of problems, such as the logic when publishing and modifying the problem content. And image resources need to be archived in the database.

Specific reference documents https://help.upyun.com/knowledge-base/cdn-token-limite/

[carlqt]

This sounds like an interesting problem. I'd like to help out but since I'm very new and unfamiliar with the App, can someone provide a "steps to replicate" instruction so I can get started quickly?

[LinkinStars]

This sounds like an interesting problem. I'd like to help out but since I'm very new and unfamiliar with the App, can someone provide a "steps to replicate" instruction so I can get started quickly?

@carlqt You can familiarize yourself with this project based on the document below.
https://answer.dev/docs/development/contributing/backend

[carlqt]

Thanks @LinkinStars , I'm able to run the app in my local but was wondering if there's documentation/steps on how to replicate this exact scenario or the url/route of this specific feature?

If not, I will just explore and see if I can find it 👌

[LinkinStars]

@carlqt This issue is still being discussed and designed. We have not yet found a suitable solution to deal with this issue. There are a lot of other situations to take into account🤔.

[carlqt]

Got it. I think I will just look for other issues that I can help out then.

I'd like to help with the discussion but I'm not sure exactly what the bug is. From my understanding, the reporter has set their uploaded image to "private" but it's still viewable for unauthenticated users.