Check file access before issuing a download
Trace a file identifier to its owner, accepted version, and download response. Test revoked access, direct-object paths, and the limits of signed URLs.
A download starts with an authorization decision about a specific stored object. Possession of a database identifier is not that decision. Resolve the requested record, its tenant or owner, its publication state, and the caller's current permission before returning bytes or issuing a link.
OWASP's authorization guidance includes static resources. Amazon S3 documents presigned URLs as time-limited access. A previously issued link has its own lifetime; ending an application session does not necessarily end that link.
Record the lookup path
Use two synthetic accounts and files with clearly different labels. Track the route from the public file identifier to the trusted storage key. The caller should not be able to replace that key with an arbitrary storage path.
| Caller and object state | Expected result | Evidence |
|---|---|---|
| Current owner, accepted file | Download allowed | Correct synthetic bytes |
| Other tenant, known identifier | Denied | No bytes and no signed URL |
| Former member | Denied under current policy | Membership removal takes effect |
| Owner, pending upload | Unavailable | Publication check precedes serving |
| Missing or deleted object | Controlled failure | No storage internals disclosed |
Check both ordinary downloads and preview or thumbnail routes. Derived files may contain the same sensitive information as their source.
Treat signed links as delegated access
Record who may issue a link, its object version, permitted operation, and intended lifetime. Avoid logging complete signed URLs. If the product requires immediate revocation, verify a mechanism that actually enforces it instead of assuming application logout is sufficient.
Test a retained link after the user's permission changes. Document the observed result and the provider's supported policy. A short lifetime reduces the exposure window but does not mean the link is single-use.
Verify denial without breaking legitimate use
After each denied request, repeat the owner's valid download. Confirm that the fix did not simply remove the file or disable every download. Inspect response caching so private bytes do not reach another user through a shared cache.
Save the tested build, caller roles, file state, and redacted link policy. Recheck after changing storage providers or introducing resumable downloads. The success condition is that every serving path applies the intended current permission or explicitly documented delegated-link lifetime to the exact object version returned.
Find the gaps before your next launch
Use the release checklist to identify changed security boundaries and missing evidence. Discuss the application paths you want reviewed before launch.