Hi, I don't know if this is the right place to ask, but couldn't find anything anywhere. With BunnyCDN token authentication, you need to include the token in the url as a query parameter. I'd like to know, for images that are part of a public page, should I just include the full url in the src or do I need to somehow serve it from the backend to prevent users copying the token from the inspector? Sry for the noob question, I'm not very experienced in web security. Any help would be much appreciated!
#Best practices for BunnyCDN token authentication for images?
vital estuary
feral moonBOT
gray fossil
Hi, I don't know if this is the right place to ask, but couldn't find anything a...
If the images are public, then the token can also be public. Of course NOT the security token! Only the generated token for the specific image
You can see, that discord for example also share details to access the specific image for a specific amount of time:
vital estuary
hey thanks for the reply! makes sense. since the image is public anyway, it needs to be accessible :). I was thinking that, but its good to have confirmation. So if i understand correctly, the token is then basically to prevent people from downloading private files in my storage, correct?
gray fossil
hey thanks for the reply! makes sense. since the image is public anyway, it need...
yea, they can only access specific images with a generated token. And to generate the token, they need the security token from bunny. But only the server know this token, so only the server can create tokens for specific images. Exactly what you want ^^
vital estuary
ok, thank you so much! all clear now
feral moonBOT