ENGINEERING NOTE / 10
Private file delivery in web apps
File handling crosses the boundary between user input, storage, and access control. I treat an upload as untrusted data and a download as a fresh authorization decision.
In this note 05 questions
What should be checked at upload?
Limit size, allow only the file types a feature needs, validate content rather than trusting the extension, and generate a server-controlled storage name. Reject failures before further processing.
Why keep private files outside public assets?
A public asset URL bypasses application permissions. Private media should be served through a route that checks the caller and the parent record, as Pulse does for conversation attachments.
Is an unguessable URL enough?
No. A long random URL may reduce accidental discovery but can be copied or leaked. The server still needs to decide whether the current caller may receive that file.
How should downloads respond?
Return the expected content type and a safe content disposition. Avoid reflecting an untrusted filename into headers, and consider whether sensitive responses may be cached by a shared intermediary.
What happens when a parent record is deleted?
Define whether its files are retained, quarantined, or removed. Database records and object storage can fall out of sync, so cleanup needs an explicit lifecycle rather than an assumption.