No Authentication for File attachment download

1

I was processing the attachment file using data action i.e. Pass the url and then process the attachment file contents on data action. During this operation found that the attachment url input to data action i.e. starting with "https://inin-prod-XXXX" is not secured i.e. any user with url can download the file ?

Am I missing some thing on configurations to make it secured i.e. to enable using Outh based genesys auth for download?

Also checking further
If I am correct - I see token details as part of url.
In that case -

  1. Can you please clarify how long this url will be active for download?
  2. Any configurable option to control the expiry?
    (Based on my understanding it is not safe to log this url on logs as it exposes data outside? - Any advice ?)
2

Hi Mohankrishna,

My understanding is that in situations like this, the security is provided by the URL being absolutely unguessable in the limited time that it is valid. So you are correct that likely anyone who has the URL can download the file, but they would effectively have to be given the URL (or as you mentioned, find it in a log).

What API are you getting this url from? The service that creates the URL will set the expiration time on the URL. It is possible that the expiration time shows up in the URL, or else we should probably have it documented in the API docs. Any configuration options around expiration should be in those docs as well.

--Jason

3

Thank you @Jason_Mathison for responding

Inbound email processed on Email flow on flow we get url from the Email object on architect i.e.
Email.Message.attachments - collection of attachments
and each attachment has contenturl.

When the email is answered the url for the attachment changes to https://api.mypurecloud...... which is secured and cannot be used to download the file (not sure on specifics like who can access and who are restricted)

Again after email is hang up the url shown on interaction report is "https://inin-prod-XXXX" this url can be shared and any one can download until the url expires.

Questions:

  1. Is there any other configuration to reduce the expiry duration of the link ?
  2. Are there any plan or roadmap for improvements?
  3. Can I get any documentation links on expiry and details on email attachment plz?
4

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.