Securely Display an Image Uploaded with paperclip gem

Question

By Default: the paperclip gem stores all attachments within the public directory.

I did not want to store the attachments within the public directory for security reasons, so I saved them within an uploads directory at the root of the app:

class Post < ActiveRecord::Base
  belongs_to :user

  has_attached_file :some_image, path: ":rails_root/uploads/:attachment/:id/:style/:filename"
  do_not_validate_attachment_file_type :some_image
end

I did not specify the url option because I do not want a url for each image attachment. If a url is specified: then ANYONE with that url can access the image. This is not secure.

In the user#show page: I want to actually display the image. If I were using all of the paperclip defaults then I could just do this because the image would be within the public directory and the image would have a url:

<p>
  <strong>Some image:</strong>
  <%= image_tag @post.some_image %>
</p>

It appears that if I save the image attachments outside the public directory and do not specify a url (again: doing this to secure the image), then the image will not render in the view.

I am aware of how to authorize throughout an application via the pundit gem. However, authorizing for an image is useless when that image is publicly accessible. So I attempt to make the image not publicly accessible by removing the url and saving the image outside the public directory, but then the image no longer renders in the view.

Update: My question really boils down to this: My images are saved within my rails application. With paperclip: is there any way to securely display an image in the view? In other words: Make it so that the image does not have its own separate url (because ANYONE with that url can access that image, making that image not secure). Here are some examples of what I mean by securely displaying the image:

• Example #1: Only display the image if the user is logged in. (The image does not have its own separate url, so there is no other way to access the image)
• Example #2: Only display the image if the user is associated to this image. (The image does not have its own separate url, so there is no other way to access the image)

Additional Update: I am aware that I can securely send a file with send_filewhich allows the user to download the image, but that is not what I want to do here. I do not want the user to download the image. Instead: I want the user to be able to actually see the image on the webpage. I want to securely show/render the image on the page. Using send_file (as I understand it) allows the user to download the file. It does not render the image on the page.

Rede

How can you display the image if it's not accessible through a URL? The only other viable option that I see would be to dynamically generate URLs that expire quickly: this is easy to do on cloud storage like AWS S3. – Portal

@Portal so there is not a way to store an image in an app and display it within a view without having an individual url for the image? I was hoping the image could be displayed just like any model's attribute. – Rede

When you use image_tag, rails just generates an HTML <IMG> tag, with the src parameter set to the image URL. The browser then will get the image from the server through the URL. Any other way would involve Javascript and be quite complicated (the only simple alternative that I see is what I mentioned in the previous comment, with a provider supporting that). – Portal

Looks similar to Rails image upload security – Addle

@Rede Did you mean something like Embed Base64-Encoded Images Inline In HTML? – Addle

Answer 1

You could use send_file. Assuming you have secure_image action in your routes:

resources :posts do
  member do
    get :secure_image
  end
end

and following method in corresponding controller:

def secure_image
  send_file Post.find(params[:id]).some_image.path
end

you can use protected images in your views:

<%= image_tag secure_image_post_path(@post) %>

What's happening here: usually Rails (or nginx or apache) sends static files directly bypassing security checks in sake of speed. But request for secure_image action goes through whole Rails' stack, so it is protected with your authentication system.

Scharff

This looks like it is what I'm looking for! I'll try it. Does this implementation not generate a public url for the image then? – Rede

The url looks like http://example.com/posts/3/secure_image but it's accessible only for authorized users (of course if secure_image action is protected). Some url must be generated in any case because when browser finds img tag it sends additional request to fetch image and browser should know url to send request to. – Scharff

Also look into X-Accel-Redirect function of nginx - in combination with send_file it can be made to still handle actual file upload after security checks, which is faster. – Jawbone

Answer 2

You can make an action in one of your Rails controllers that validates the user's identity/authority to view the image. Instead of rendering a view, the action can then send the image in its http response using send_file:

http://api.rubyonrails.org/classes/ActionController/DataStreaming.html#method-i-send_file

Then once you get that action working on its own and you can see that it displays an image in your browser, you can make img tags that point to the url of that action.

Each image would have its own URL, but you would be in total control of what that URL is and who can access it.

Anvil

Thank you for your answer. If I am understanding your answer correctly: I do not think it solves what I am trying to do. I updated my question. Please see the 'Additional Update' section at the bottom of my question. Thanks! – Rede

Whether a file gets downloaded or displayed can be controlled by the HTTP Content-Disposition header, if it isn't doing the right thing by default. I see that you accepted an answer that is very similar to mine except it has some code samples so you have probably figured out by now that send_file does actually do what you want. – Anvil

Answer 3

You can convert image into Base64 format and while displaying can convert that into image.

Other technique is to watermark your images to make sure image is useless for others.

Trews