Protecting assets in Confluence

We have Crowd/Confluence connnector that prevents unauthorized users from accessing the Confluence-rendered pages.

However, anyone (include external remote hosts) can still access directories such as images, includes, and other files. Is there any way to prevent access to these from non-authorized users?

For example, to view content on our Confluence site, you'd need a login to view http://mysite.com. However, you could access images, for example, at http://mysite.com/images/en_GB.gif or raw decorator source files, for example, at http://mysite.com/decorators/admin.vmd.

Does anyone else see this as a security issue?

2 answers

The images directory in your instance contains a lot of the standardized Atlassian logos and images that we use all around the site that need to be accessible to anonymous viewers. For instance, your site logo on the Confluence login page has your site logo stored in /images/logos, and without anonymous access, the user would just see a broken image link when logging in. All images uploaded to your site by users are behind the /download/attachments resource, which is login protected so long as you don't have the global and space permissions for anonymous users set.

As for the Velocity files, I'm unfortunately a little less knowledgeable about the need for anonymous access to the content. However, if you haven't made any customizations to the files themselves, they should not have any information to worry about. More importantly, the anonymous access to either of these resource locations does not inherntly put you site at risk.

FWIW, I figured out a way to do this using the Seraph-based authentication that is built into Confluence. This is the same authentication that protects the "admin" panel. I'll blog about it and try to capture the steps to use it.

Steven Behnke Community Champion Feb 12, 2015

Please do!

Suggest an answer

Log in or Sign up to answer
How to earn badges on the Atlassian Community

How to earn badges on the Atlassian Community

Badges are a great way to show off community activity, whether you’re a newbie or a Champion.

Learn more
Community showcase
Posted Jul 10, 2018 in Confluence

We want to see the templates you've created in Confluence!

Hi Community, Jessica here from the Confluence Product Marketing team!  July’s community challenge is all about sharing pictures  — and as an extension of our first post on what ...

940 views 23 12
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you