mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-06 12:55:03 -05:00
Shareable links still valid after expiration or deletion #33
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#33
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cusergit on GitHub (Jan 23, 2025).
Hello,
I create "Shareable link" for one of my resources (1 hour expiration).
The link is visible under "Manage Share Links" with creation and expiration times.
The link works well, I can access the resource with no problem.
After some time ( 1 hour I guess ) the link has been deleted as expected ..
but it is still valid, I mean I still can access my resource from any machine/browser.
The same occurs if the link is "deleted" before expiration, the resource still can be accessed any from machine/browser.
Expiration time is how long the link will be usable and provide access to the resource.
After this time, the link will no longer work, and users who used this link will lose access to the resource._
Thanks
@miloschwartz commented on GitHub (Jan 23, 2025):
I am trying to reproduce this but so far I am unable to, and the links do expire, but I will keep trying with different values.
Also wanted to ask:
Are you accessing the share link from a browser that is already logged in with SSO? Does this still occur if you access the resource via the share link from an incognito window that has never been logged in before?
I am asking because the share link does not override the other auth methods if they were previously used. You must also have at least one auth method enabled on the resource for the share link to provide temporary access, as otherwise, the resource is accessible to everyone anyway.
@cusergit commented on GitHub (Jan 24, 2025):
Hello, thanks for your reply.
Yes , I have tried from different machines and browsers without previous login to pangolin or the resource itself and still occurs.
No, I don´t have any authentication method (not even "Use Platform SSO") , so I guess that the cause.
I am aware of the warning in the documentation:
It is not recommended to expose a resource without some form of authentication.
Only do this if you need to for the functionality of the resource or you trust the built-in auth
but don´t you think it is a valid use case ?
Many thanks for your time.
Regards
@cusergit commented on GitHub (Jan 24, 2025):
Sorry, I realized that's nonsense.
When using the share link, a redirect will be made and my resource URL will be perfectly visible.
Thanks