Make downloading Bags more secure

[mjordan]

#15 introduced a feature that allows Bags to be downloaded. However, anyone who knows the URL to the directory where the Bags are exposed for downloading has access to all Bags, which is obviously very insecure.

We need a way of allowing Bags to be downloaded that provides more robust security.

[mjordan]

Some constraints:

• If the files are just exposed for download, we can't use Symfony's IP-based firewall since the user could be anywhere.
• We want to avoid adding user-management functionality to Islandora Bagger.
• Bags should not hang around longer then they need to. Pruning the downloads directory frequently is probably a very good idea. However, this would mean that the user downloading the Bag needs to know how long it will be available.

[whikloj]

Token download? We had something like this in our Document Delivery department where the patron would get emailed a token and could use it to download the item once (maybe twice) and there was also a deadline. So once the token was used up or the deadline passed it was removed.

[nikathone]

I am currently trying to containerize the Islandora bagger and I was thinking if we bind mount the Drupal private directory in the bagger container it could save the bags in a specific directory and a Drupal module could be responsible of downloading and cleaning up that directory.

I will update my finding later today but please let me know if this is not a good approach. Thanks again for all the work on this module.

[mjordan]

@nikathone sounds good to me. https://github.com/mjordan/islandora_bagger_integration already exists so it could manage access to the bags in the private directory. Whatever it does should not be required but configurable by the site admin. I am happy to work building this into that module if you want. However I have one question - are use of the private file system and the public filesystem mutually exclusive or can we do what you are describing and still allow for use of the public filesystem at the same time?

[nikathone]

are use of the private file system and the public filesystem mutually exclusive or can we do what you are describing and still allow for use of the public filesystem at the same time?

Drupal allows user to set and use both directories in the settings.php See https://git.drupalcode.org/project/drupal/-/blob/8.8.x/sites/default/default.settings.php#L501 and /admin/config/media/file-system for more information.

[nikathone]

Right now for testing purposes I am setting the drupal private path under /home/vagrant/drupal_private_files. Since the vagrant home directory for islandora claw playbook is synced with the vm host under <path-to-islandora-claw-playbook> that will add a drupal_private_files on the host. I can then bind mount this folder inside the bagger container.

For production server configured with the playbook the private files will be set on the host and both Drupal and container should have access to it.