Home/ Questions/Q 761189
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T15:48:30+00:00

Here’s a story: User A should be able to upload an image. User A

  • 0

Here’s a story:

  • User A should be able to upload an image.
  • User A should be able to set a privacy. (“Public” or “Private”).
  • User B should not be able to access “Private” images of User A.

I’m planning to user Paperclip for dealing with uploads.

If I store the images under “RAILS_ROOT/public/images”, anyone who could guess the name of the files might access the files. (e.g., accessing http://example.com/public/images/uploads/john/family.png )

I need to show the images using img tags, so I cannot place a file except public.

How can I ensure that images of a user or group is not accessible by others?

(If I cannot achieve this with Paperclip, what is a good solution?)

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I would have Paperclip use S3 on the back-end, set uploaded files to private, and then use “Query String Request Authentication Alternative” to generate the URLs for my image tags.

    http://docs.amazonwebservices.com/AmazonS3/2006-03-01/index.html?RESTAuthentication.html

    • 0