-
Notifications
You must be signed in to change notification settings - Fork 38
Implementation
Todd Dembrey edited this page Apr 8, 2020
·
5 revisions
Media is encouraged to be split into two distinct storage locations. A Public and a Private location, applicant media should exist only in the Private location. This is for two reasons:
-
This separates the site media, which is served publicly with no authentication, from the Applicant media, which has permissions checks, it reduces the risk of a miss-configured storage exposing the Applicant data.
-
Maintains separation between the two halves of the platform, Apply and Public.
Media should also be served from a view that inherits from the PrivateMediaView which will confirm that the file isn't made public and can be configured to return the file object from an authenticated view.