File Management module with unauthorized issue when downloading the uploaded files #2324

3 Answer(s)

• 

  -1

  cotur created 2 years ago

  Hello @trendline ,

  Files that uploaded with File Management module can't be downloaded directly by a link for now. We've added "token validation" for extra security.

  First, the UI makes a request to the backend application to take token, that token will be used for download, Example:

  UI makes a request -> // api/file-management/get-token / [FILE-ID] Token = 12345 UI opens a new tab with the url -> api/file-management/[FILE-ID]?token=12345 Then the download process will start.

  Tokens become expired when they used once. If you want to disable that, for each download request, you need to consume new token.

  So, how you can achieve your request, let me show you one example.

  You may create unique tokens for each dowload request by overriding DownloadAsync method of FileDescriptorController controller:

  Note that, you need to secure your api yourself.

  [HttpGet]
          [Route("download/{id}")]
          [AllowAnonymous]
          public virtual async Task<IRemoteStreamContent> DownloadAsync(Guid id, string token)
          {
              var fileDescriptor = await FileDescriptorAppService.GetAsync(id);
              
              // add this
              if(string.IsNullOrWhiteSpace(token))
              {
                  token = await FileDescriptorAppService.GetDownloadTokenAsync(id); 
              }
              
              Response.Headers.Add("Content-Disposition", $"attachment;filename=\"{fileDescriptor.Name}\"");
              Response.Headers.Add("Accept-Ranges", "bytes");
              Response.ContentType = fileDescriptor.MimeType;
  
              return await FileDescriptorAppService.DownloadAsync(id, token);
          }
  

  Save Cancel
• 

  0

  trendline created 2 years ago

  Thanks for your detailed explanation, I will try to override the DownloadAsync method in the FileManagement module. Although the links which in the uploaded files list, with a token as the query string, but it still cannot be verified when click the download link to preview the file, is this not updated with 5.0.0?

  Hi @cotur, could you have a look on this issue? The File Management module already got a token then bind to the link to get a file, but it still has this issue.

  Save Cancel
• 

  0

  maliming created 2 years ago

  Support Team Fullstack Developer

  hi trendline

  Can you share full steps to reproduce?

  Save Cancel