[Rails] Re: strategies for securing attachment files from unwanted access

2009-04-07 Thread Frederick Cheung
On 7 Apr 2009, at 17:52, Alberto Perdomo wrote: > >> That but use X-Sendfile or X-accel-redirect: this makes apache/nginx >> send the file, rather than funnelling it through ruby. All your rails >> controller does (assuming the person is authorized) is set a header >> in the response saying 'se

[Rails] Re: strategies for securing attachment files from unwanted access

2009-04-07 Thread Alberto Perdomo
> That but use X-Sendfile or X-accel-redirect: this makes apache/nginx > send the file, rather than funnelling it through ruby. All your rails > controller does (assuming the person is  authorized) is set a header > in the response saying 'send them this file') How does X-Sendfile behave when tur

[Rails] Re: strategies for securing attachment files from unwanted access

2009-04-07 Thread Jack Bauer
Oddly enough, I was just reading an article about how to pull this off in Nginx right before coming here: http://ramblingsonrails.com/how-to-protect-downloads-but-still-have-nginx-serve-the-files To do so with Apache just use libxsendfile -- Posted via http://www.ruby-forum.com/. --~--~--

[Rails] Re: strategies for securing attachment files from unwanted access

2009-04-07 Thread Matthew MacLeod
On 7 Apr 2009, at 16:43, apm wrote: > 2. Store attachments outside of public and serve them using a > controller and send_file. I think this works for download links but > what about embedding images? There shouldn't be any reason that you can't get this to work for images. One of the other p

[Rails] Re: strategies for securing attachment files from unwanted access

2009-04-07 Thread Frederick Cheung
On Apr 7, 4:43 pm, apm wrote: > Hi, > > So, what can you do to protect people form accessing file they should > not? I have compiled a list of possible strategies we have thought > about or read about on the internet: > > 2. Store attachments outside of public and serve them using a > controll