Thank you for the suggestion. I'm not so familiar with this. Will this work on frontend too? If I expose the secrets on the fronted, then it's pointless.
Do you have some suggestions on how to do this?
Appreciate the help! It's an important aspect and a very resource intensive process that I need to protect.
back
2 comments
To the extent that you are pulling new stories directly from Firebase on the client side, encrypting (or signing) urls with a symmetric key will not work. This is because you would need to embed the secret in the front-end code which means the secret is no longer secret ;-)
You could also tail the Firebase feed from a server process, generate the relevant images and only serve images for pre-existing urls.
Your decryption/encryption secret (key) is stored on the server side only and if a client requests a thumbnail, you can validate the URL value by successfully decrypting it with this secret and probably do a simple HTTP URL validation check of the decrypted value.
And you have to encrypt all thumbnail URLs with this secret before passing them to the client.