Gate actual gallery pictures behind auth #118

New Issue

Open

opened 2026-05-11 13:30:11 +02:00 by felixalb · 2 comments

felixalb commented

2026-05-11 13:30:11 +02:00

Owner

Expected behavior:

Visiting https://www.pvv.ntnu.no/static/gallery/adriangl/xkcd/newest-xkcd.png yields HTTP 403 Forbidden for unauthenticated users

Observed behavior:

Visiting https://www.pvv.ntnu.no/static/gallery/adriangl/xkcd/newest-xkcd.png yields a dank meme for unauthenticated users

Possible solutions:

Instead of serving the images directly from a directory, make the website app serve them (https://www.pvv.ntnu.no/galleri/img.php?user=adriangl&file=xkcd/newest-xkcd.png or similar), validating user auth
- Should probably integrate tightly with #64
- Might allow for stats/view counters, and similar additional features, if we want them
Make the web server check for a valid/active session (cookie) before serving images

While, the gallery browsing page (https://www.pvv.ntnu.no/galleri/) is a dynamic php thingamabob that makes sure you are authenticated and allowed to view the gallery, the actual pictures are hosted directly/passively by the web server from a directory. ### Expected behavior: Visiting https://www.pvv.ntnu.no/static/gallery/adriangl/xkcd/newest-xkcd.png yields HTTP 403 Forbidden for unauthenticated users ### Observed behavior: Visiting https://www.pvv.ntnu.no/static/gallery/adriangl/xkcd/newest-xkcd.png yields a dank meme for unauthenticated users ### Possible solutions: - Instead of serving the images directly from a directory, make the website app serve them (`https://www.pvv.ntnu.no/galleri/img.php?user=adriangl&file=xkcd/newest-xkcd.png` or similar), validating user auth - Should probably integrate tightly with https://git.pvv.ntnu.no/Projects/nettsiden/issues/64 - Might allow for stats/view counters, and similar additional features, if we want them - Make the web server check for a valid/active session (cookie) before serving images