Django: Password protects url's photo?

Question

From my Django app, I want to serve secure photos. Photos are not intended for public consumption, I want users to be able to view them. I don’t want to rely on obfuscation of the id of the file (giving a photo of the UUID of a long number) and count on the fact that it is hidden in my media folder. How can I safely store a photograph on disk in my database and transfer it only to an authenticated session?

Answer 1

Use the X-Sendfile headers to tell your server that which file the server really is.

@check_permissions
def image(request):
    response = HttpResponse(mimetype='image/png')    
    response['X-Sendfile'] = "/real/path/to/image.png"
    return response

. , , Satchmo LoadableProduct.

, nginx lighttpd X-Accel-Redirect X-LIGHTTPD-send-file X-Sendfile.

Answer 2

, HttpResponse mime , / .

:

from django.http import HttpResponse

@your_favourite_permission_decorator
def image(request):
    response = HttpResponse(mimetype='image/png')

    with open("image.png") as img:
        response.write(img.read())
    return response

. PDF PIL.

Answer 3

Apache mod_python, Apache Django.