How to keep private images private - php

I have some Users in my API Service Authenticating with OAuth, via a Web Client (website).
When the User requests their private profile images.. how should these be served up? I see a few options few drawbacks and unsure what's the best decision going forward.
1) host the images with a hashed name... eg (~/public/folder/309dsfas928f39rjkfe93.jpg)
Pro
- Simple, keeps all assets centralized to the Apigility based server.
Con
- nothing preventing something from finding an image .. no of assuring access control once a URL is found.
2) pass back the img data in a JSON request
Pro
- You're assured that the person receiving an image has permission.. every time the image is accessed
Con
- now images need to be stored (temporarily?) on the WebClient's server..
- images traveling in JSON seems wrong to me
Are there datastreaming options instead? Thank you

Nice question!
Right now I have a solution where I pass the image in a base64 encoded sting in the json response. This works nicely and on the client side you can quickly paste the string in the src tag of the html image. So when it comes to workflow it is very smooth.
But I guess others might have something to say about this solution :P

Related

Symfony 4 - Endpoint for uploaded files

I've developped an simple FileUploader Service based on the Symfony documentation found here: https://symfony.com/doc/current/controller/upload_file.html
My app is just a simple API called inside a Ionic Mobile App.
What I want to know is what is the best practices to give access to my uploaded images.
For exemple, I have an Sport entity App\Entity\Sport that stores an image:
When i request GET /api/sports/ I want to send as response the full url to the image so it can be displayed inside the mobile app (e.g. http://symfony/api/public/uploads/sports/XXXXX.jpg)
Maybe I'm overcomplicating the issue but do I need to make an GET /public/uploads/sports/{id} as an endpoint to get my pictures ? because if possible i would like to have the pictures instantly available after the GET /api/sports and not having to query another time for the picture aswell
Why not just simply add the URL into a field of the JSON response object, where you can access the the picture directly? IMHO there is nothing wrong with that.
I find https://github.com/WhiteHouse/api-standards a good reference to start with if it comes to these kind of decisions.

API-centric web application file upload

I am creating an API-centric web application using PHP. I have read a lot of articles on API-centric arhitecture and design, but I have a problem related to file uploads.
Suppose I have an image and I want to upload it to the API server. How should I upload that image and how then to receive the link to that image?
Here is how I want to create it now:
Select an image using <input type="file"> on client www.domain.com
Upload it to the www.domain.com using POST with multipart/form-data
Send this image with PUT/POST API call to the api.domain.com
api.domain.com will save this image to another server like static.domain.com and will store image's id in the database
Then, when I will need this image, I can use GET API call to the api.domain.com and I will receive image's url (something like static.domain.com/image.jpg)
Aditional questions:
Is this approach the right one or I am doing completely wrong?
Will I need an aditional server to store uploaded files if my application will be small, or I can store files right on the API server?
If I will store images on same server as API server, won't it be strange if image urls will look like api.domain.com/image.jpg?
P.S: We can skip a lot of API-related things as I need only an idea on how to deal with file uploads.
You haven't really said what kind of API that you are going to be implementing here, so I assume that it is just a restful API.
Is this approach the right one or I am doing completely wrong?
No, I wouldn't say you're doing it wrong. You would essentially send the file using POST.
Will I need an aditional server to store uploaded files if my application will be small, or I can store files right on the API server?
Yes, it will allow you to store this on the same server, I don't see why not. I doubt that you will use a lot of storage, if the application is small.
If I will store images on same server as API server, won't it be strange if image urls will look like api.domain.com/image.jpg?
The api.domain.com/image.jpg technically is just the URL that you connect to the API with and GET/POST data. It does not mean the file is going to be that URL. The API could return like:
{
type: "IMG",
id: "1",
url: "example.com/uploads/image.jpg"
}
I hope this this helps, even a little!

Generating encoded URL's for file sharing stored on amazon S3

I am working on file sharing for objects stored on amazon S3.Now the path for the object stored on S3 is default like this https://s3.amazonaws.com/bucket_name/path_to_file/file_name.jpg/docx etc.Now I want to share these file URLs via email through my app.
Currently when I share I see the entire URL as is in the email.I want it to be sent in an encoded form so that its hard to guess the exact location of the file.
I am using PHP and I was planning to use base_64_encode/decode functions or md5 the URLs but not sure if thats the right way to go.
So,I am looking for some tool or API (by amazon ot 3rd party) that can do it for me.
I would also like to shorten the URLs while sharing.
Would like to seek advice and guidance from someone implemented something similar.
Not sure if it comes under URL-REWRITING but tagging it under it.
Thank you
You have two options to do this:
You can map your url and s3's url in your server, and give your url to user. When user make request to your url, redirect it to s3's. You can ref http://en.wikipedia.org/wiki/URL_redirection
You can call API provided by url redirect service provider, e.g. tiny.cc/api-docs

Cloudfiles API with SNET set to true seems very slow

So I did as suggested here.
But I'm still seeing some pretty slow responses when getting URLs for files stored in containers on cloudfiles.
The application I'm building has a portion where users can comment. Each user has a profile image which shows up next to their comment. The basic structure of the code is as follows:
1) Authenticate cloudfiles api
2) Open connection
3) Retrieve main users profile image
4) Retrieve all comments from database
4.1) Loop through users comments
4.2) Get container and file name from DB
4.3) Retrieve image from CloudFiles
5) Close connection
I have SNET as true and I am on a Rackspace server but, it seems to crawl in comparison to when I stored them directly on the server. Also the reason I am not storing the public url in the database is due to the user being able to change their image and me wanting to store past images, therefore not overwriting the past image. I could store each past image's url as well as the new images and probably will do that but, wanted to see how fast I could get it prior to doing that.
The reason I am hesitant to go straight to storing each images public url is because on another portion of the site I am going to use Temp URLs for some secure files and am trying to see if I can fix the performance in general.
Any suggestions are appreciated!
Thanks

How to retrieve link to an image from CakePHP to Android?

I'm fairly new with CakePHP and images so bear with me. You can assume I'm using the latest version.
I'm trying to build an Android application which can display images retrieved from the server.
Suppose I have an image in the assets folder called football.jpg. How would I store this in the database and then how would I output this to the Android application? Do I send only the link or do I send the whole image over? If it is just the link, does this mean I would have to reconnect to the server with the link and then get the image? Sorry if this doesn't make sense. Still trying to get my head around it.
Just a word of caution, it's probably better to store the file on the server's file system and store the path to the file in the database. The reason behind this is that BLOBs are stored in a different area on the file system to all your other typical data and in terms of retrieval, its not a great deal faster.
Here's a link to what I mean: Store pictures as files or in the database for a web app?
With regards to returning it to your Android app, you can send files in the response object (http://book.cakephp.org/2.0/en/controllers/request-response.html#cake-response-file):
public function sendFile($id) {
$file = $this->Attachment->getFile($id);
$this->response->file($file['path']);
//Return reponse object to prevent controller from trying to render a view
return $this->response;
}
This should give you finer control over what files are returned to your client.

Categories