Securing File Downloads

A protected file presents an easy-to-overlook authorization problem. Many file servers map URL paths to files, and if the server doesn't check that the requester is allowed to access a file, any authenticated user can download another user's file by changing the URL.

The simplest solution is often to avoid exposing the file directly. Instead, the server checks permission and then streams the file to the authorized user.

file, found, err := store.FindByID(request.Context(), fileID)
if err != nil {
  return err
}
if !found || (file.UserID != current.User.ID && current.User.Role != "support" && current.User.Role != "admin") {
  respondNotFound(responseWriter)
  return nil
}
serveDocument(responseWriter, request, file.OriginalName, file.ContentType, file.StoragePath)

Sending a file with Go's net/http package does not decide who should receive it. The authorization check needs to happen before the handler streams the file.

The storage path should also come from trusted server-side metadata, not directly from a URL parameter. Treat the URL's file ID as an untrusted reference, then resolve it through a database or other server-side mapping.

A secure direct-download flow follows one guarded path:

1. Authenticate the requester.
2. Load the file metadata.
3. Authorize access to that file.
4. Send the file to the authorized requester.