How to serve files with access control in Django?

Question

When studying Django, the typical way to handle uploading files was to create a folder media on the server - establishing a MEDIA_ROOT and a MEDIA_URL in the settings.py - where any uploaded file would go. In the templates, a FileField or ImageField is created, whose upload_to is related to MEDIA_ROOT. In production, the webserver itself (e.g., Apache) is expected to serve the content of the URL /media, leaving only dynamic content to Django.

So far so good, the problem is that I would like to restrict the access of files "uploaded" to logged in users, according to some access control criteria. What is the right way to do this? Is it Django’s or Apache’s responsibility to do this access control? (and if it’s Apache, how to make it use Django’s permissions system?)

For reference, here’s how my virtual host (usage Django 1.4.14):

Alias /media/ /var/www/vhosts/example.com/httpdocs/media/
Alias /static/ /var/www/vhosts/example.com/httpdocs/static/

WSGIDaemonProcess exemplo threads=15 processes=5
WSGIProcessGroup exemplo
WSGIScriptAlias / /var/www/vhosts/example.com/exemplo.wsgi

P.S. For performance reasons, I would prefer that not all the /media had access control - the case of files uploaded by the user that are universally accessible is more frequent than the case where the file is restricted. I could assign a subfolder to them (ex.: /media/restrito) and let Django take care of that folder, but I don’t know how to do it with just the Alias and WSGIScriptAlias. Maybe I need the mod_rewrite also, I do not know... Anyway, I am quite lost, any reference on the subject would be very welcome.

Answer 1

One solution I found to serve (non-static) files is using X-Sendfile. Basically, the application view (in the case of Django) checks that the user is logged in and sends the request with a header (to Apache or Nginx) stating that he is authorized to download.

This feature is documented in this link: http://wiki.nginx.org/X-accel

No Django, Settings:

import os
BASE_DIR = os.path.dirname(os.path.dirname(__file__))
DIR_PROTEGIDO = os.path.join(settings.BASE_DIR, 'protegido')

views:

def arquivo(request):  
    # verifica se o usuário está logado        
    arquivo = '.../arquivo.jpg'
    response = HttpResponse()
    response['Content-Type']=''
    response['X-Sendfile']= os.path.join(settings.DIR_PROTEGIDO, arquivo)
    return response

And in Apache:

XSendFile on
XSendFilePath "//arquivos/protegidos"
<Directory "//arquivos/protegidos">
    Order Deny,Allow
    Allow from all
</Directory>

I didn’t get to use and I don’t know if it’s efficient, but from what I read it seems to be a good solution to serve files (NOT static) with prior authorization, whenever someone tries to access the file URL without the header passed by Django will fail, in case the view will be intermediary in this process.

References I found:

• http://wiki.nginx.org/XSendfile
• https://tn123.org/mod_xsendfile/
• https://stackoverflow.com/questions/24631585/xsendfile-with-apache-and-django

Solution in Django:

• https://github.com/johnsensible/django-sendfile

Answer 2

I have two suggestions. The first uses more server features and ensures more privacy, and the second, which is used by Facebook to store images, performs better, but uses aloe URL pattern.

CASE 1: Use language (or server) to restrict log-in user-based static file access

1. Place the files in a location not normally accessible, for example, a folder above its equivalent to www or public_html
2. Use your programming language, where you have full control to know which user is authenticated, for when a URL is accessed, it checks the user and, if allowed, reads the private image and exposes it.

CASE 2: Store image in a location accessible by anyone, but URL difficult to predict

1. Place the image in a location accessible to anyone, but should have a very complex URL.
   1. Do not use sequential number! .
   2. md5 simple is not random enough, also do not use.
2. Store this random URL and only display it to users you want to have access to it.

---

My recommendation: when in doubt, use CASE 1. CASE 2 is interesting only in more peculiar cases, as on Facebook. Another situation of CASE 2 is to allow access to files without authentication, only with URL sent by email, common in emails to billboards.