Skip to main content

Control access to public images

Digital Admin

Hi,

I've been given a new requirement to an existing solution. Basically any upload to Cloudinary now need to accesses by a user with a bearer token.

Currently the image is public. E.g.

 
So my solution is to extend our service that manages uploads to Cloudinary so as to be able to request images/video. E.g.
 
(this is implemented)
With a valid Auth header (this is something we already have implemented on other services).
 
My Question is:
The original Cloudinary URL is still valid and open to the public. Can i make only specific Cloudinary folders/directories/collections  publicly or private? As some content still needs to accessed and public. Can this be done retrospectively?

 

0

Comments

2 comments

Date Votes
  • Wissam Khalili

    Hi,

    There's an overview of different access control options available here in our documentation, and it includes information about restricting how new derived assets can be created in your account and how access to retrieve existing assets can be controlled: https://cloudinary.com/documentation/control_access_to_media

    At a high level, there are two sets of features to look at.

    To protect the original files and control how derived (transformed) versions of your assets can be created, the features to look at are 'private' images (protects the original) and 'strict transformations' (controls how new versions can be created). This can be done on any plan including our free plan.

     

    To control how access can be made to existing derived images also, the 'authenticated' type requires authentication to be provided when requesting images.

    This would require a signature in the URL in order to access those assets. Since you are requesting those assets from your server to Cloudinary, they shouldn't really be exposed to your end-users. If a user gets that URL with that signature, they will be able to access the file as well.

     

    There are different forms this authentication can take depending on your account's plan and your exact requirements; some options require our Advanced plan or higher, and some, like cookie authentication, require that a custom domain is used for delivery. There's a breakdown here:

    https://cloudinary.com/documentation/control_access_to_media#authenticated_access_to_media_assets

    Hope this is helpful!

    Thanks,

    Wissam

     

    1
  • Digital Admin

    Thank you

    0

Post is closed for comments.

Didn't find what you were looking for?

New post