The outcome

Let users work with files without making host data, other users' uploads, generated assets, or a local workstation publicly reachable.

Step by step

A workflow you can repeat.

  1. 01

    Inventory upload, static, cache, temporary and output paths, allowed file types and sizes, users, retention, sharing need, malware controls, and every route that can return a file URL.

  2. 02

    Use a dedicated empty working directory, keep allowed_paths to exact approved locations, set blocked_paths for secrets and system data, avoid broad static directories, and configure a private cache root.

  3. 03

    Validate signatures and size before processing, rename uploads to generated IDs, sandbox parsers, strip metadata where appropriate, never pass user text through as a file path, and authorize each download.

  4. 04

    Avoid share=True for production; if a temporary tunnel is necessary, assume it is public, add basic protection, use non-sensitive test data, monitor it, and terminate it immediately after the review window.

  5. 05

    Test traversal, symlinks, hidden files, arbitrary returned paths, cross-user guessing, oversized and malicious uploads, cache races and deletion, then expire generated files and verify URLs no longer resolve.

Working standard

What good use looks like.

  • Never return user-supplied paths.
  • Keep allowed paths exact and minimal.
  • Treat share links as public tunnels.

Official references

Check the current product documentation.