I have a simple Flask app that lets you download an image protected by a login. There are simply two routes:
example.com/login
http://ift.tt/2eVVxPW
You can't access "downloadpage" before you have successfully logged in. That's working fine. The folder structure looks like the following:
--flaskapp.py
----static
------images
--------background.png
--------protectedimage.png
------stylesheet.css
The login page looks like this:
< body style="background:url('../static/images/background.png');">
<!--Login-->
</body>
If you now go to example.com/login
and change the source code in the browser by clicking inspect in Chrome for example you can easily change '../static/images/background.png'
to '../static/images/protectedimage.png'
the protected images will be set as background and you can easily save it. How can you prevent users from being able to do that? Of course I want them to be able to download the protected image by clicking the download button on http://ift.tt/2eVVxPW
.
Aucun commentaire:
Enregistrer un commentaire