在网络服务器 ASP Net Core/Angular 上保存私人图像的最佳实践

Question

In my Angular app users can register/logged in and upload private images. This images are shown immediately in the formular after the upload. At the moment the images a stored in folder

string imageDictionary = $"{_HostingEnvironment.WebRootPath}\\\\{User.Identity.Name}\\\\UploadFiles\\\\";

The folder and image name is stored in the database.

What is the best way to make sure that the images can only be access by the user how are logged in? At the moment is it possible to call the image if the link are known.

Is it enough if I disable directory browsing and give the image a random created name?

I use for backend ASP Net Core and for frontend Angular version 7.

Answer 1

I would recommend you use Azure Blob storage since already have security protection

If you want to store your file in wwwroot folder you need to add middleware to check for user permission before you let them see the file because wwwroot folder is a public folder which everyone can access