Refined access control for uploads

tompatrick

3 weeks ago

15

• 

  Arskeliss

  3 weeks ago

  I'm no expert, nor know how to implement it in code, but the logic would be to allow public access to the underlying URL && some kind of an custom access control hook which allows only the uploading user to their own uploads. Right? I guess you need to check the access control and hooks docs, there are examples on the payload github

• 

  thgh

  3 weeks ago

  I got a similar issue. I think the best way forward is configuring strict access controls and then add a custom endpoint that exposes all data

  
  

  
  

  Another option would be to add an express middleware that adds a filter (by modifying req.query) if the request referer contains /admin but that is probably a rabbit hole.

  
  

  
  

  And another idea: configure the access controls such that anonymous read is allowed but authenticated read is limited to your own.

• 

  tompatrick

  2 weeks ago

  Thanks @Arskeliss and @thgh. In the end I found a way using the cloud storage plugin. I enabled public read ACL, and disabled the access control via the plugin which reveals the actual object storage URL instead of the rewritten payload one. And then I just added a CDN onto the cloud storage in this case via digital ocean and added the rules I needed in the collection config. Works well.

• 

  mihanc

  2 weeks ago

  Hi. How can I bypass the access restriction via custom endpoints?

  
  

  If I understood correctly, the restrictions apply to each endpoint

  
  

  
  

  Solved it by adding overrideAccess

• 

  Arskeliss

  2 weeks ago

  You are using this inside payload or your frontend?

• 

  mihanc

  2 weeks ago

  Inside payload.

• 

  thgh

  2 weeks ago

  The global payload object cannot take access restrictions into account as it is not aware of who is querying? Or are you using req.payload (which I think is also unrestricted but starting to doubt that now)?

• 

  mihanc

  2 weeks ago

  Seems it take into account the restrictions. At least it didn't work until I added the overrideAccess as true

  
  

  
  

  In the documentation says that if the overrideAccess is false, you have to pass the user to use against the access control checks.

  
  

  
  

  So another solution is to create a dummy user object and use it to bypass the restriction. But for me overrideAccess: true looks better

• 

  thgh

  2 weeks ago

  Well, the docs say the default is true so that's peculiar. (Which matches my experience)