Sharing, Links & Measurement

Access Control

Definition

Access control answers two questions in order. Authentication asks who is making the request — a password, a sign-in, a token. Authorisation asks whether that party is allowed the thing they asked for. Full application platforms carry both, with per-person accounts, roles and a permission record for every object. Static hosting works at a coarser grain: the unit being protected is a file or a whole published address, and the gate sits in front of it rather than inside it. The controls available are therefore blunt but dependable — a password on the address, an expiry date, a restriction by country, or simply an address that is long enough not to be found. None of them know the name of the person on the other end.

Why It Matters

Most leaks are not break-ins; they are a link that was never gated at all, pasted into a thread that grew. A salary review published as a public URL is one forward away from everyone, and search engines index what they can crawl. Choosing the right gate is also a cost decision: a password on a client deck takes ten seconds and removes ninety percent of the risk, while building per-user accounts for four reviewers takes a week and a server to run it on. Be honest with yourself about which threat you are defending against, then pick the cheapest control that covers it.

How It Works

On a static host the check happens at the edge, before any bytes of the file are served. A request for a protected address gets a form or a 401 instead of the content; once the password is accepted, the edge sets a short-lived cookie or token for that browser and serves the file on subsequent requests. An expiring link works on a timestamp rather than a secret, refusing to resolve after a set moment. Geoblocking and IP rules compare the connecting address against a list before the cache is consulted. What none of this provides is a per-person permission model, so there is no way to grant Sam access and revoke Alex — revoking means changing the password or retiring the address for everyone. A robots.txt file keeps honest crawlers away but is a request, not a lock.

Real-World Example

An accountancy practice publishes a 12 MB year-end pack at fernside-yearend.99helpers.site for three directors. The address carries a password and expires on 31 October. One director forwards the link to an assistant, who is prompted for the password and stops there. When a fourth director joins in November, the practice republishes under a new address with a new password rather than trying to add a person to the old one, because the gate covers the file, not the individual.

Common Mistakes

  • Relying on an unguessable address as the only control — a link pasted into a public ticket or a chat log is then permanently open
  • Assuming a password on a page also protects the assets it loads — images and PDFs referenced by direct path can remain reachable on their own
  • Using robots.txt to hide a sensitive file — it is a polite instruction to crawlers and a public list of the paths you would rather nobody visited

Related Terms

Put a file online in seconds

Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.

Host a file free →