13.3 Shared Links, Expired Links, and Privacy Leaks
Anatomy of a Share URL
A share URL has two security-relevant parts. The path segment selects the object -- bucket, folder, file ID. The trailing random token is a capability: possession is authentication. There is no session, no cookie, no login step behind it. If the token has, say, 24 hex characters of true randomness, guessing it is astronomically unlikely; short or sequential tokens are enumerable, and "security by obscurity" links built from guessable IDs leak in bulk. The token's scope is also fixed at creation: which file, which permission level, which expiry.
Link Types and What They Really Enforce
An anyone-with-link grant enforces nothing beyond possession. A password-protected link adds a server-checked secret, but the link itself still reveals that something exists and stays brute-forceable if the password is weak or reusable. An expiring link is enforced at request time -- the server refuses the token after its TTL -- which is the single most effective default control, because it bounds the damage window of any copy. Pair expiry with download blocking and comment/view-only rights so a legitimate viewer cannot silently fork the content.
Where the Copy Comes From
Links leak through channels you do not control: chat forwarding, email forwarding, browser history on shared machines, HTTP Referer headers on pages you link to from a document, and -- most quietly -- unfurling. Link-preview bots in messaging platforms fetch your URL and cache a title, thumbnail, or snapshot; search-engine crawlers and web archives do the same for any link they ever see. Once a copy is indexed, revoking the token at the origin stops new fetches but cannot recall cached snippets or downloads. Treat expiration as damage limitation, not deletion.
Operational Defaults
Prefer named grants over public links, default expiry to days not never, rotate links when a collaborator changes, and periodically re-open your own old links to see what still resolves.
Architecture Diagram
Key Takeaways
- A share token is a bearer capability: possession of the URL is the only authentication performed.
- Token entropy decides guessability -- short or sequential share IDs can be enumerated in bulk.
- Password gates add a secret but still reveal existence; expiry is the strongest default because it bounds every future copy.
- Preview bots, crawlers, and archives cache content at first sight; revoking a link cannot recall cached copies.
- Default to named grants, short expiry, and view-only rights; periodically re-test your old links.