In our application, user can book appointments and upload/attach documents with the appointment. Once appointment is created, the Agent (Super User) get an email notification of the Appointment with a table listing all documents attached and there download URL.
Our requirement is that this URL to download the document should be accessible to only someone who has logged in (authorized).
Normally in our application, all our Backend APIs require Authentication (bearer token). But since URL for download document is a plan URL in email, I don't think we can attach the token with this url right? How can I achieve this?
What we tried: We added a secret key to the same URL and we are validating the secret key at our server level (api). But the problem is still the same, if an unauthorized user somehow gets the access to the email or URL, they will still be able to access the email. How can we achieve this?
[HttpGet, Route("download-doc/{key}/{appointmentID}/{documentID}")]
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status400BadRequest)]
[ProducesResponseType(StatusCodes.Status500InternalServerError)]
[AllowAnonymous]
public async Task<IActionResult> DownloadOpenDocument(string key, string appointmentID, string documentID)
{
try
{
var docKey = _configuration.GetValue<string>("Entities:DMSOpenKey");
if (string.IsNullOrWhiteSpace(key) || key != docKey)
throw new UnauthorizedAccessException("You don't have required permissions for this access.");
var (documentBytes, contentType) = await _apptDocumentService.DownloadDocument(appointmentID, documentID);
return File(documentBytes, contentType);
}
catch (ArgumentException ex)
{
return HandleUserException(ex);
}
catch (Exception ex)
{
return HandleOtherException(ex);
}
}