Hello, I’m self-hosting Medplum and I’ve configured file storage like so: "binaryStorage": "file:/var/lib/medplum/binary/", "storageBaseUrl": "https://api.**.ai/storage/" With this configuration the files are accessible and download correctly, however the resulting URLs appear to be publicly reachable: anyone who knows the URL can download the file. I have two questions: Is there a supported way to restrict access so that only authenticated/logged-in users can download files? If yes, can access policies (roles/permissions) be applied to those file URLs (for example, only users with a given role or the resource owner)? For clarity, my desired behavior is: /storage/ endpoints should require authentication (or use short-lived signed URLs) rather than being permanently public. Thank you. @rahul1 , @finnbergquist

Hi @thomabig ! Are these URLs publicly reachable even without the key pair in the URL? That would be unexpected, but otherwise all URLs are presigned for a certain period of time (the key pairs are rotated in and out)

Hi @Maddy You're totally right ! I didn't see the Expire and Signature parameters. So just to be sure : - Presigned Url are only available for a user who is logged in and for which the access policy authorize the access to the documentReference ? - Presigned Urls are generated on the fly when accessing a DocumentReference Resource ? - Is there anyway to reconstruct a Presigned Url ? What's the algorithm behind it ? - Is there a way to modify the expiration duration ? Thank you so much

You can only retrieve a pre-signed URL if you are a user who is logged in and has an access policy that authorized you to access that DocumentReference resource. However, anyone with the pre-signed URL can view it. This is a because pre-signed URLs are used all the time for data migration, sending data to printers/external devices, etc., and is industry standard https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html

Great, thanks for all the info ! that's all I needed 😉