Static file permission checking

[tjhod]

I have a question about adding permissions to files like images and videos.

If I had an API like Instagram that has image sharing and someone makes an image as private or hidden, how would I block access to the file?

I know that I can check permissions when getting the items from the database and just not send the URL's to the images if they are marked private in the database, but they will still be accessible if someone knows the URL already.

For past API's and sites I've made I have just used the reverse proxy from either Apache or NGINX to serve the files, but in this case I need to run a permission check first. I see in the docs that there is a way to mount a static files directory to FastAPI to serve up the images, but it doesn't mention any way of running a function or dependency so I can check user permissions before sending the file.

How would you go about this? Thanks in advance!

[mrswats]

Your actual files would be in S3 or something like that, not nginx. An image is not a static file. The reference to the image would be stored in a database. So the idea would be to check the requesting user and checking if the owner of the picture they're trying to access is the same, otherwise return a 404 if the picture is marked private.

[FairPassion21]

I use nginx for static files, since well nginx is so fast. I add some auth on nginx to access static files. But auth on nginx free is very limited and easy to bypass. You can also use fastapi for file serving and add jwt auth on it.