Downloading assets on S3 through carrierwave

Question

I have a carrierwave uploader chapter_pdf_uploader configured through fog for S3. I can make that resource available for download through a view with -

<% @chapters.each do |chapter| %>
  <%= link_to 'download pdf', "#{chapter.chapter_pdf}" %>
  .....

Is this safe?

I have config.fog_public = false .

Answer 1

No this is not safe at all. If it's downloadable to some user using direct link you provided. Then anyone can download using the link. If you want to give permission for download to specific users then you should read that file on your system/app then make it available to your user using send_data or send_file methods.