Secure Public Share Links
Give a public share link narrow data scope, expiry, and an honest revocation rule.
A public share link deliberately crosses a tenant login boundary. It should grant a narrow view of one object, not access to the tenant account. The link may be copied, forwarded, saved by a preview service, or retained after the issuer leaves. Treat it as a capability with a documented lifecycle. OWASP Authorization supports separate rules for each action and resource.
Share capability table
| Decision | Question |
|---|---|
| Issue | Who may create a link for this object? |
| Scope | Which fields and attachments can it show? |
| Audience | Anyone with the link or named recipients? |
| Expiry | When does it stop working? |
| Revoke | Can the issuer end it early? |
| Audit | Which use is recorded without exposing visitors? |
| Tenant removal | What happens when the owner tenant is deleted? |
Do not place the token in analytics events or logs. Avoid putting private identifiers in page titles that preview bots can collect. If immediate revocation is required, verify the storage and cache path can enforce it. A short expiry alone may not meet that requirement.
Test the exception
Use a synthetic private record and a distinct share view. Check that the link returns only approved fields and does not expose related private objects. Test update, export, and attachment routes with the link; a read grant must not enable them. Revoke the link, wait past its expiry, and check both edge and origin behavior. Remove the issuer's membership and apply the product's written rule. Try a changed object ID in the owned fixture and require denial.
OWASP Multi Tenant Security defines the normal boundary. This capability table describes the intentional exception. A random-looking URL is not proof that scope or revocation works. Keep real customer links out of public examples and initial security inquiries.
Inspect the response headers on the shared view. A private attachment URL or token in a referrer can escape to another service even when the HTML body is narrow. Keep the capability out of analytics and log fields, then verify expiry through the deployed edge path.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.