search

OkunaOrg / okuna-api

🤖 The Okuna Social Network API
https://okuna.io
MIT License
242 stars 79 forks source link

World circle posts should not be accessible when profile is set to private #735

Open lifenautjoe opened 4 years ago

lifenautjoe commented 4 years ago

The timeline is blocked already by this setting but a post can still be accessed directly with its UUID, we must add a check there to make sure it isnt if the profile is set to private and the person is not a follower.

evict commented 3 years ago

Actually a UUID is perfectly fine for this type of thing. UUIDs are not guessable, the risk is negligible really. Just make sure that when using the web app you add the noindex header and/or tags: https://developers.google.com/search/docs/advanced/crawling/block-indexing. This will prevent indexing when someone accidentally shares the link on a public site.