Protecting FluentCommunity media stored in Cloudflare R2
Hoping someone else may be a step ahead of me and able to offer some advice. I created a Cloudflare R2 bucket to offload the media files for my Fluent Community. Seeing the note in the documentation about using a custom domain (instead of the public domain provided by Cloudflare), I also successfully connected the main domain to Cloudflare, created a custom domain, bound it to the R2 bucket, and updated the FluentCommunity settings to use that domain. That all works, but there is still have the concern of the content in the R2 bucket being available to the public and not just to the members of my community.
Support told me a good approach would be to set up a Cloudflare Worker as a media proxy and I've been working on code to verify if the user is a community member and then issue a JWT token and set a cookie that can be passed to the Worker to say it's OK for the user to have access to the files in the R2 bucket. I've been trying to get this to work, but the setup of the FluentCommunity plugin is pretty complex to figure out where you can hook in to do something like this.
And now the latest reply back from Support says: "Clouldflare R2 files needs to be publicly accessible... otherwise, the integration might not work. To achieve your use case, you can use the WordPress's default file upload location(inside wp-content folder which is public) and restrict the files for non logged-in user's using .htaccess rules. I am afraid the aren't any workarounds available apart from this."
(This directly conflicts what an earlier reply on my support thread said, so I'm not sure what to think.)
My community has many GB of files and videos so storing them in the WP media library is impractical. That's why I was excited to see that FluentCommunity offers connections to R2 or S3! But if access can't be protected, that's a no-go for a paid membership. And sadly, in trying to figure all this out, I'm well past the 14 day refund window for FluentCommunity. I'm so sad right now feeling like I've wasted both money and time. This post is a last effort to see if maybe someone else has input that would help.
David Fore Roger Bunch Shahjahan Jewel - Tagging you all on this because I see you've discussed things adjacent to this topic before
I haven't done this yet, but it looks like there are some access controls with Cloudflare R2 that may fix your issue. Check out this doc:
The idea in my head is that the access control only allows the user specified for your domain to control what's pushed and pulled from the bucket and displays it on the community site.
I could be way off because I'm speculating, but it's a place to start if you haven't tried this already. It's similar to the idea of a Cloudflare Worker as a media proxy, but perhaps with less hassle. I'll test it out myself later on.
William Beem Interesting. I was operating under the assumption that each community user would need to individually access the files in the R2 bucket in order to utilize them (read a file, view a video, etc). And because the site has all kinds of logged in users, some of whom are not community members (i.e. maybe they're just making a purchase from the WooCommerce store on the site), I was approaching it that I need to verify the user is part of the community and issue token/set cookie to pass to the Cloudflare Worker. But if I'm reading your comment correctly, are you saying that really only one things (an Admin user? the site itself?) needs access to the R2 bucket in order to DISPLAY the content in the community and then community members (as long as they are logged into the community) would be free to use it without needing further access to R2? Maybe I've been looking at this all wrong... (I'm definitely in over my head and very close to throwing in the towel and telling my client FluentCommunity isn't going to be a good solution for her needs!)
That's my theory, but unconfirmed. The idea of using a proxy or a bridge to handle access is something I do frequently, but I haven't confirmed it works in this specific case.
Here's an example where it doesn't work. I'm at a client site today where they block YouTube. Any YouTube video shared on this site won't show up, so there's no proxy access for OEmbed videos on FluentCommunity.
It's worth a look, though.
There has two type of files:
- Media Files: These are static files (Images), wherever you store them, those will be publicly accessible. But FluentCommunity rename the files and add long hash so people can't guess the media URL. Now if one of your member copy the URL and share the link, then anyone can access with the link. But even if you sign the URLs they can just save the image and share with others. It's true for Facebook, Twitter, Instagram all. That's how internet or browser work. You can't truly protect an image being copied. Not theoretically/practically possible.
- Documents: We have document module, where the URLs are signed and only logged-in users (with access) can download. But again, anyone can download and share with others.
My suggestion is, you should not be too worried about the media get accessed by others as only the persons can leak an URL or dowbooad and send to others.
Shahjahan Jewel Sure I understand that there is always the possibility that anyone from within the community can copy and share things. I am not really too worried about that. Most people, once they have paid for access to something, won't do that. But I am concerned about the files in the R2 bucket being freely available to the entire world, logged in or not.
Karen Dec Again, how will a random user get the URL? Those URLs will not be indexed for a private space. So someone will get a specific media URL if that was shared by someone.
Shahjahan Jewel OK I see what you are saying. I've managed to make it so the top level of my R2 bucket is not public. Beyond that, people would have to have the URLs which they are only going to have from inside the community. However, I still have a problem. I turned on the Documents module for one of my spaces. I have successfully uploaded both a file and a video and it put them in the R2 bucket with signed URLs as you said. However, even though I posted these uploads to the feed, they are only downloadable NOT viewable right there within the community. I'd rather have the images and videos show up to be seen/watched right within the community (that way most people probably won't even download them). Is this an option? I also tried just starting a new post and embedding the video that's in R2 with an iframe code but that didn't work either. Wondering if I would have to use Cloudflare Stream in order to embed iframe for video in R2 bucket?
Back to say that I got a sample iframe code from a friend's Cloudflare Stream account so I could test it in FluentCommunity and it does work. Unfortunately this means paying monthly for Cloudflare Stream but at least it's cheaper than Vimeo.
Karen Dec try https://bunny.net/ pricing
Also yoi migjt be interested in presigned urls: