Media = Content, so what about Public Access?

Questions
1

Hi all,

I know there are packages available for protecting media, which is great, but it feels like something Umbraco should support out of the box considering it’s just a feature that would benefit the CMS greatly.

If Media = content, why shouldn’t the same Public Access concept apply to both?

Curious to hear the reasoning and what others think, or perhaps if Umbraco addressed this ever.

2

Hi @konius

Content and media have similarities, but they aren’t the same thing. Media has no concept of publishing and no rollback in the backoffice, and it points to physical files that can be served from shared storage. I know they feel similar, and they share much of the same database structure, but they serve different purposes.

As far as I know, protecting media has simply never been a requirement for core, which is why several packages have appeared over the years to that solve this. Media is served as static files, so requests don’t go through the normal Umbraco routing pipeline. That keeps them fast, and processed images are also cached by ImageSharp. Adding protection would mean routing every media request through the application, which carries a performance hit, and protected media cannot be cached by a CDN.

I’m not aware of an official reason, but it’s a requirement I’ve come across before.

Justin

3

Thanks Justin. I do understand the technical differences between Content and Media, particularly around routing, static file serving etc.

My point with “Media = content” wasn’t that they are technically the same thing inside Umbraco. It was that from the perspective of someone managing a website, media is part of the website’s content and sometimes needs exactly the same access restrictions as a page does.

For example, if I protect a members-only page, but the PDFs, documents or images used by that page remain publicly accessible through their URLs, then the access restriction is incomplete.

And again I know that you can have surface controllers that route the display/download action so you don’t expose the actual URL, but that’s not the point.

Users using the CMS are not aware of the technical differences and can easily copy/paste the URL or simply add something by mistake to an unprotected area.

Furthermore, to achieve this without paying for a package require meddling with .net, controllers, middleware and generally intercepting a request.

Without proper understanding it’s easy to introduce issues with the site or have gaps in security if those documents really need to be protected.

4

Hi @konius

I completely agree, you may want to open a discussion with HQ and ask them directly as I’m not sure you will get an official response on here (unless someone from HQ replies to this thread).

I know there are discussions around improving the media library, but I don’t know if this involves protecting media.

Justin

5

Hi,

Thank you, I created the discussion here if anyone wants to join and share their thoughts:

6

Shameless plug. I thought exactly the same 10+ years ago and wrote a package for it

Best,

Richard

7

@rsoeteman absolutely fair shameless plug :grinning_face_with_smiling_eyes:

My point isn’t that packages such as Media Protect shouldn’t exist. Clearly there has been a need for this functionality for a long time.

Since you’ve been dealing with this problem for 10+ years, do you know if there’s a particular reason it has never made its way into Core?

I know Umbraco position shifted multiple times, but generally was that it’s a content management system, however in a lot of cases media is content.

8

I think (not sure) because it is more complex to protect static media (and keep performance steady) than it is to protect content where you have full control over what you serve. The dialog is the easy part I can tell you :wink: