Permission to images missing

[madsh93]

Preflight Checklist

• I have completed all Troubleshooting Steps.
• I'm on the latest version of Directus.
• There's no other issue that already describes my problem.

Describe the Bug

Hi

I have a data collection with a data model, that contains some text, prices, colors and an image.

My issue is that, images from this specific data collection returns 403 forbidden. I can access the id without problems. However, when accessing the file either through the admin dashboard or api localhost:8055/assets/id it errors.

When I upload some new images it works just fine, for a couple of hours until permissions are missing again. All permission are set All Access

To Reproduce

1. Upload images through a data collection
2. Works for some hours
3. 403 Forbidden

Errors Shown

{"errors":[{"message":"An unexpected error occurred.","extensions":{"code":"INTERNAL_SERVER_ERROR"}}]}

What version of Directus are you using?

9.0.1

What version of Node.js are you using?

16.13.0

What database are you using?

Supabase - v12.5

What browser are you using?

Chrome

What operating system are you using?

macOS

How are you deploying Directus?

Locally or render.com

[azrikahar]

I can access the id without problems.

However, when accessing the file either through the admin dashboard or api localhost:8055/assets/id it errors.

Can you share what was the exact way/method of accessing that was without problem?

403 Forbidden

{"errors":[{"message":"An unexpected error occurred.","extensions":{"code":"INTERNAL_SERVER_ERROR"}}]}

I believe you mean this error showing on client side right? But it is quite odd how 403 Forbidden shows as Internal Server Error which should be error code 500 instead 🤔

---

Locally or render.com

Are you using any free tiers from render.com by any chance? Not super familiar with it, but typically free tiers may have limitations which may explain your periodic outage/issues.

Since you've mentioned it worked for "few hours" at times, it's probably not session-related, but still possible nonetheless. Would you mind testing this on a different browser, or even Chrome Incognito? just to rule out any extensions/browser config related issues 👍

[madsh93]

Hi @azrikahar

Yeah, sorry I was a bit tired when posting this bug. I posted the wrong error message. This is the one I am getting:

{"errors":[{"message":"You don't have permission to access this.","extensions":{"code":"FORBIDDEN"}}]}

I can't seem to find the pattern as to when it happens. Its not all images in the file library. It only seems to happen on images in this specific collection.

I am not on a free tier with render.com, and the issue also seems to happen locally.

.

tldr - I will continue to investigate when and why this is happening to me.

[madsh93]

My theory is that when I add images through production, and later redeploy to production I haven't got the uploaded images locally, therefore they are missing when I push to production. How do you guys handle this?

[azrikahar]

Since this is now confirmed to not be an actual bug, but more of a setup/configuration matter, opted to move this to discussion 👍

---

My theory is that when I add images through production, and later redeploy to production I haven't got the uploaded images locally, therefore they are missing when I push to production.

Ah that makes sense. Just to clarify why the permissions issue is happening, it's more of a security approach to prevent enumeration of assets-ids to find out what are the valid assets. That's why missing images are still "shown" as no permission instead of actually missing.

How do you guys handle this?

I think for local file storage, it'll be quite difficult as you'll need to ensure they remain the same IDs. Would you mind elaborating how are you doing the "redeploy" here? Assuming you did redeploy the "uploads" folder, then that definitely shouldn't be in the redeploy process here.

[madsh93]

@azrikahar That makes sense as a security approach.

I have decided to just go with a third party storage solution. Going for Google Cloud Storage now. Would prefer to use something like Cloudinary, but that seems to not be possible without a custom integration with the storage adapters.

[azrikahar]

I have decided to just go with a third party storage solution. Going for Google Cloud Storage now.

Having a third party storage does indeed help to alleviate some potential drawbacks with local storage. Glad it's a viable option for your use case 👍

Would prefer to use something like Cloudinary, but that seems to not be possible without a custom integration with the storage adapters.

That's true, I believe you are referring to #3107 here. There is also an alternative route using custom interface + display detailed in the article linked over here: https://twitter.com/directus/status/1367152702170529793, though I've yet to personally try it. Just sharing it in case it can be helpful 😄

[bastianhilton]

i'm having the same issue with a docker install, any idea to fix this?

[DanielBiegler]

Depends on what exactly your problem is. You might just be missing the image files so copy your uploads folder over with the needed hashed names so that Directus can find the images. If you need further help I'd suggest writing down the steps that you took/want to take and open up a help thread. This one is two years old. Thanks! :)