Give every share link a random token and an expiry

How to do it

People forward share links, paste them into chats and leave them in old emails. So treat each link as a password for one file. Make the token with the system's secure random source, and store only its hash, as Store API keys as hashes does for keys. Give each recipient a separate link, so one can be revoked alone. Show the file's live links on its page, with the last time each was opened. Send Referrer-Policy: no-referrer and X-Robots-Tag: noindex on the share page. Each download still goes through short-lived links. Deleting the file ends its links and purges its copies, as Purge cached copies when a file is deleted or removed says.

Examples

JavaScript example

import { createHash, randomBytes } from 'node:crypto'

const TOKEN_BYTES = 16
const token = randomBytes(TOKEN_BYTES).toString('base64url')
const tokenHash = createHash('sha256').update(token).digest('hex')

Python example

import hashlib
import secrets

TOKEN_BYTES = 16
token = secrets.token_urlsafe(TOKEN_BYTES)
token_hash = hashlib.sha256(token.encode()).hexdigest()

How to check

Create a link and open it signed out. It works, and the response carries both headers. Revoke it, and the next request answers 410. A link past its expiry answers 410. The stored row holds a hash, not the token.

Sources

• W3C Good Practices for Capability URLs
• Google robots meta tag and X-Robots-Tag

Related rules

• API-42 Store API keys as hashes in API design
• MED-46 Serve private files through short-lived links in Files and media
• MED-21 Purge cached copies when a file is deleted or removed in Files and media