您如何在Golang中安全地提供文件

Question

I'm new to developing web applications. I'm working with golang and would like to serve user uploaded files securely, such as allowing them to view their own files only.

Now I have saved those files to a local file system with random names. If I serve the entire directory, malicious users may view other users files. This sounds like a common use case, I wonder what's the best approach to deal with it?

Answer 1

This question in pretty vague and architectural decisions must be made to optimize data access and secure the files.

However, here is a simple solution that might serve your use-case.

package main

import (
    "fmt"
    "mime"
    "net/http"
    "path/filepath"
)

//UserFilesMap is the map that contains
var UserFilesMap map[string]FilePermission

type FilePermission map[string]struct{}

//FileServer is the function that serves files
func FileServer(w http.ResponseWriter, r *http.Request) {
    //get the file path the user wants to access
    filename := r.URL.Path[9:]
    var uname, pass string
    var ok bool
    if uname, pass, ok = r.BasicAuth(); !ok {
        w.WriteHeader(http.StatusForbidden)
        return
    }

    if !(uname == "user" && pass == "1234") {
        w.WriteHeader(http.StatusForbidden)
        return
    }

    //Checking if user has permission to the file
    if _, ok := UserFilesMap[uname][filename]; !ok {
        w.WriteHeader(http.StatusForbidden)
        return
    }

    w.Header().Set("Content-Type", mime.TypeByExtension(filepath.Ext(filename)))
    http.ServeFile(w, r, "files/"+filename)
}

func main() {
    UserFilesMap = make(map[string]FilePermission)
    // UserFilesMap["user"] = FilePermission{"xyz.txt": struct{}{}}
    UserFilesMap["user"] = FilePermission{"abc.txt": struct{}{}}
    http.HandleFunc("/getFile/", FileServer)
    if err := http.ListenAndServe(":8080", nil); err != nil {
        fmt.Println("Error in ListenAndServe")
    }
}

Here, I used a map to store the permissions of files. I would suggest you go for a SQL table instead.