Closed aleksihakli closed 4 years ago
Hi @benoitbryon and @Natim, would this be something that is needed in this project? I could implement this in a PR but would like to know if there has been any previous discussion or opinions on the subject.
@aleksihakli feel free to do so if you think it is still interesting yes.
I'll try and find time for making a PR. The example code should work as-is. I've tested it locally in the past. It could be added to the codebase with a few unit tests.
@Natim the docs seem to be of the old version by the way, is it possible to update the RTD site with the new contents which also describe using the new configuration options?
Yes I asked @benoitbryon about that. But we might consider asking someone from RTD to give us access.
Hi there :) @Natim, I just granted you maintainer of django-downloadview on RTD. Is it ok for you? Feel free to make the changes you think are necessary.
Thank you Benoît I will have a look
Le mar. 14 janv. 2020 à 23:05, Benoît Bryon notifications@github.com a écrit :
Hi there :) Natim, I just granted you maintainer of django-downloadview on RTD. Is it ok for you? Feel free to make the changes you think are necessary.
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/benoitbryon/django-downloadview/issues/138?email_source=notifications&email_token=AABYATPICSWOUFY2GLB6E5DQ5YZLTA5CNFSM4DFCGB3KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEI6JP6A#issuecomment-574396408, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABYATINNY3NFUTZNZU6SR3Q5YZLTANCNFSM4DFCGB3A .
Hi,
tl; dr: Would this project benefit from the ability to sign download URLs (cryptographically and with expiration)?
I thought I would open a discussion on adding download URL signatures.
I recently implemented cryptographic authorization on top of URLs that were generated directly by the storage backend, much like with S3.
These were served with nginx by using X-Accel and a custom view that generated serve requests to the proxy server, offloading the file serving from Django.
The idea is fairly simple and I think many people could benefit from it. Implementation just requires
The best thing is that download views will work with or without the signature.
Following a naive example of the idea of the implementation. Please bear in mind that these examples are untested and would, of course, need to be further adapted for
django_downloadview
.Then the usage can simply be:
The S3 Boto storage backend uses a similar approach and makes it possible to generate URLs in user templates and then authorize S3 access with those URLs. This vanilla Django approach makes it very easy to emulate that behaviour.
Additional hardening can then be achieved with:
{{ file.url }}
This approach only lacks in that it introduces non-cacheable URLs that require slight computation to decrypt.
Inspiration was received from Grok. You can find more information on generic URL signatures in his weblog:
If signatures are appended to URLs with existing query parameters, a more sophisticated solution has to be used. For example: