No authentication required to access attachments

[18f]

No authentication required to access attachments

[afeld]

Wow, thank you for the 🐛 report! Added to our issue tracker here:

https://www.pivotaltracker.com/story/show/98143198

Will update here when it's in progress or done, unless you would be interested in taking a crack at it 😉 Thanks again!

[cmc333333]

Hi @anthonygarvan! Thanks for taking a look.

Attachments are stored in an S3 bucket and accessible only with a timed authentication code. It's currently set to expire after ten minutes, meaning that, if you visit that url ten minutes after copy-pasting, you'll get an authentication error. Relying on S3's authentication means we don't bog down the application servers with proxy traffic, but we might want to consider limiting the timeout to something shorter.

So, authentication is needed, you're just passing it along with the URL. It'd be akin to sharing your session key. Does that make sense?

[anthonygarvan]

Ah, gotcha. Makes sense. No, 10 minutes is reasonable. I'll close the issue, seems like it's not a real concern.