Is there a way to restrict accessing files only to logged in users?

[DursyArts]

Is there a way to restrict accessing files only to logged in users?

[BobbyWibowo]

Sorry, unfortunately something like that would require overhauling the session system altogether.

In short, there's really no easy workaround. At best, you can only do some kind of nginx IP-based rate limit on the files' location block. Though that'll only slow scrapers a bit, and can't really handle netbot scrapers with multiple of IP addresses.

---

For the technical explanation, this fork's session system rely solely on the visitors manually providing an auth token in each of their requests (this is automated by the frontend). As such, there is no "session cookie".

So even if you serve files with Node, to have the ability to programatically check for login status, it just can't. When browsers are fetching your files normally, the auth token won't be shipped in the requests, because it's not a cookie. So even programatically it's not possible to check login status.

On that note, I believe upstream chibisafe, https://github.com/chibisafe/chibisafe, already transitioned to using session cookie. So something like that should be possible with some modifications, if not right out of the box. I haven't checked their codes in a while, but Pitu/Kana, its author, is typically active on their Discord if you want to ask more.