Go to main content

Textpattern CMS support forum

You are not logged in. Register | Login | Help

#1 2019-11-12 19:18:03

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Plugin idea: time-limited and/or attempt-limited file download URLs

Take the following example file:

https://dev-demo.textpattern.co/file_download/6/devrandom_10mb.txt.zip

That URL will work over and over until the administrator or file owner removes it from Files. I’ve had cases where files were time-sensitive and, for various reasons, access was disallowed after a given date. Files don’t have an expiration date, but that’s for another thread.

Now I have a situation where having Files available for a given time period would be very helpful, with a URL token being the identifier, essentially disposable after the ‘expiry’ date. Related, I can also see a use case for tokenised downloads, where the token allows a certain number of downloads before it self-destructs.

So, my example above might become something akin to:

https://dev-demo.textpattern.co/file_download/abc123def456/devrandom_10mb.txt.zip

The token (i.e. abc123def456) would be generated on demand, and each File record would have a list under the file details of valid / used tokens, perhaps assigned to an email address or something else.

E-commerce packages that handle digital downloads do this already, the URLs are sometimes rather unwieldy, but I’m thinking the namespace / length could be defined somewhere.

Does this have legs, or is it just me?

Edit: unlink the link.

Offline

#2 2019-11-12 21:30:12

Bloke
Developer
From: Leeds, UK
Registered: 2006-01-29
Posts: 11,415
Website GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Does smd_access_keys deliver any mileage in this regard? I could compile up the latest version if you want to try it out. The most recent bundled version on GitHub is a little out of date.

EDIT: and if it needs any tweaking to make it more useful, by all means make suggestions and I’ll see what I can do.

Last edited by Bloke (2019-11-12 21:31:06)


The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.

Txp Builders – finely-crafted code, design and Txp

Offline

#3 2019-11-12 21:38:00

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Bloke wrote #320033:

Does smd_access_keys deliver any mileage in this regard? I could compile up the latest version if you want to try it out. The most recent bundled version on GitHub is a little out of date.

That looks promising, thanks for the pointer. I’ll gladly give it a spin if you’re able to push the latest version – brilliant!

Offline

#4 2019-11-12 21:51:42

Bloke
Developer
From: Leeds, UK
Registered: 2006-01-29
Posts: 11,415
Website GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Done. Enjoy the ride.


The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.

Txp Builders – finely-crafted code, design and Txp

Offline

#5 2019-11-12 21:52:13

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Amazing – thanks very much, I’ll report back.

Offline

#6 2019-11-13 10:34:17

Bloke
Developer
From: Leeds, UK
Registered: 2006-01-29
Posts: 11,415
Website GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Incidentally, one thing I might consider (if I can make it work) is a pref to decide the token length. 32 chars is perhaps overkill so it might pay to have it truncate to 8, 12, or 16 for sanity/shareability sake. I think internally, it might still keep the full token but only spit out and match URLs representing the first N chars as governed by your setting.

It could potentially weaken the security, as brute-forcing, say, 8 chars of a hash is far faster than a full 32, but at least site admins then have a choice.

Will think about it. Views / ideas around this concept welcome.


The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.

Txp Builders – finely-crafted code, design and Txp

Offline

#7 2019-11-13 14:18:05

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Bloke wrote #320044:

32 chars is perhaps overkill so it might pay to have it truncate to 8, 12, or 16 for sanity/shareability sake.

It could potentially weaken the security, as brute-forcing, say, 8 chars of a hash is far faster than a full 32, but at least site admins then have a choice.

For me, it depends on the site URL, and the filename…and the email client. Webmail often has line breaks in long URLs, they work most of the time, but something that can avoid a break would be preferred for me.

Visually:

http://example.com/file_download/a1b2c3d4/08char_hash.txt
http://example.com/file_download/a1b2c3d4a1b2/12char_hash.txt
http://example.com/file_download/a1b2c3d4a1b2c3d4/16char_hash.txt
http://example.com/file_download/a1b2c3d4a1b2c3d4a1b2c3d4a1b2c3d4/32char_hash.txt

See also this – and adjust sums to taste:

However, you are looking to prevent an online brute force attack, which is much slower. If you wanted 12 hex characters, this would be 6 bytes and therefore 48 bits of entropy. This gives you 281,474,976,710,656 possibilities. If your site takes 0.25* seconds to respond, this would take 2^47 * 0.25 = 35,184,372,088,832 seconds to brute force on average by making requests to your site (1.116 million years).

Offline

#8 2019-11-13 14:27:09

Bloke
Developer
From: Leeds, UK
Registered: 2006-01-29
Posts: 11,415
Website GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Agreed, 12-16 chars is probably ample for most uses. I’ll see if I can add this in the next version.


The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.

Txp Builders – finely-crafted code, design and Txp

Offline

#9 2019-11-13 14:27:30

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

You da best!

Offline

#10 2019-11-13 14:33:25

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Bloke wrote #320054:

Agreed, 12-16 chars is probably ample for most uses. I’ll see if I can add this in the next version.

Using HSIMP (unclear whether it’s an offline or online attack, random-ish lowercase hex strings, before quantum computing is widespread):

  • 4 char hex: 42 microseconds
  • 8 char hex: 1 minute
  • 12 char hex: 4 years
  • 16 char hex: 6 million years
  • 20 char hex: 11 trillion years
  • 24 char hex: 18 quintillion years

Offline

#11 2019-11-13 14:34:43

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,218
GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

Since nobody asked…:

  • 64 char hex: 3 sesvigintillion years

Offline

#12 2019-11-13 14:39:40

Bloke
Developer
From: Leeds, UK
Registered: 2006-01-29
Posts: 11,415
Website GitHub

Re: Plugin idea: time-limited and/or attempt-limited file download URLs

:)


The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.

Txp Builders – finely-crafted code, design and Txp

Offline

Board footer

Powered by FluxBB