fpm-auth: Check Image Permission

[AbrarNitk]

Check referer document permission from the request headers.

Doubt: If a document foo contains an image, while the user requests for an image and in referer it contains the same foo, why do we need to check the permission again of document foo, we have already checked the permission of foo.

[amitu]

If a document foo contains an image, while the user requests for an image and in referer it contains the same foo, why do we need to check the permission again of document foo, we have already checked the permission of foo.

Because referer can lie. Say a secret image is known to exist at foo.com/secret.png, which is only included in foo.com/secret/, but foo.com/ is public, so someone can send a request to foo.com/secret.png with referer set to foo.com/.

You have to both verify that http requester has enough permission to view foo.com/ which they will, and that foo.com/ includes foo.com/secret.png (which it does not), so this will fail.

If request to foo.com/secret.png comes with foo.com/secret/ as referer, when you perform both check, both will be true for a person who has access to foo.com/secret/.

Please note that you can not use any information about what you verified in the "last http request", you can not expect the two requests are coming from same machine etc.