Documents can be downloaded without a username PWD

Unknown

Documents can be downloaded without a username PWD

Unknown

Hey support,

I have a custom workflow that returns a URL which can be used to download a file which has been saved as a document. The pattern I used was recommended by Will and generates a URL like this:

Get pdf:

[url=https://merrilldev01.decisions.com/aria/Primary/?DocumentId=d1443ad5-0aba-11e8-b722-00155d142d0e&FileName=Statement.PDF&RequestInfo=ATPr5MzIbVYy59WKN2OfEXMn1q1S1XbxG0WQ/c0iSw/HBuIMxWxFJnlUmddxISbai0kFcqYICbbqKgeJ+/5Yn3D1r8WWorAaxSc5yVdcsf5R6VRvplwFtfRJoSGC68+i&ChangeTimeStamp=05022018132341&Size=190432]https://merrilldev01.decisions.com/aria/Primary/?DocumentId=d1443ad5-0aba-11e8-b722-00155d142d0e&FileName=Statement.PDF&RequestInfo=ATPr5MzIbVYy59WKN2OfEXMn1q1S1XbxG0WQ/c0iSw/HBuIMxWxFJnlUmddxISbai0kFcqYICbbqKgeJ+/5Yn3D1r8WWorAaxSc5yVdcsf5R6VRvplwFtfRJoSGC68+i&ChangeTimeStamp=05022018132341&Size=190432[/url]

The problem is, this URL doesn’t require credentials to access. It’s in the wide world, so it could be exploited. Is there a way to rewrite the URL so that it can’t be run without credentials and the file can still be downloaded?

Unknown

Hi,

The RequestInfo Parameter Contains an Encrypted SessionID to use for Authentication. I would recommend that you remove it and only send in the DocumentID if you want to make sure that the User Logs into the Portal before downloading.