Segmenting cache by current user or tenant

[rolftimmermans]

An issue was flagged internally because in our application a user might theoretically have access to files from another user if they can figure out the cache's file id. Although this is not trivial in itself (and may require other vulnerabilities to be exploitable), it is also not theoretically impossible because the file id is sent to the application frontend after uploading to the cache.

Based on the principle of defence in depth, we would prefer to segment the cache by current user. Each model that has the possibility to have a Shrine file attached to it, has a user_id column. How can we instruct Shrine to read files to/from cache/#{user_id}/#{file_id}?

Presumably it is possible to make user_id part of the generated location. But this sort of defeats the point, because then the user-supplied cache location contains the user_id, which would then have to be validated before accepting it. Ideally the user_id part is only used internally by Shrine and not stored or transmitted anywhere. What is the recommended approach here? Has anyone else treated this as a security issue?