Accessing an Uploaded File

Required Data

In order to access an uploaded file, you need two pieces of information:

• File Upload Id - each uploaded file has a unique, system-assigned integer value
• Security Guid - each uploaded file also has a unique, system-assigned GUID used to "sign" the download link (see below)

The File Upload Id is not considered a "secure value" and is able to be sent over the network.

The Security Guid is a secure value and is used to prevent unauthorized access to uploaded files. It should never be transmitted over an unsecured network connection.

The most common way to expose this information is through a custom report or database view that is available to program administrators.

Accessing the File

To access an uploaded file you must construct a "signed" URL utilizing both a date stamp and the Security Guid of the uploaded file. 

• The date stamp allows you to share the link with an untrusted third party by limiting the amount of time that the link is good for. By default, file download links are valid within two hours of the date stamp passed in the securityDate parameter. (The timeout is a system-wide configuration setting)
  
  
• The Security Guid is used to generate a hash code that is appended to the URL. This ensures that the URL is not modified; any attempt to modify a different upload Id, or to modify the date stamp, will invalidate the hash code and prevent the file from being downloaded.

Sample C# code for computing {hashCode}

Constructing the hash code should be fairly straightforward in any language or platform that has a SHA256 implementation. Here is sample code for C#:

private string GenerateHash(int uploadId, DateTime dateTime, string securityGuid) {
	var sha = SHA256.Create();
	var stringToHash = uploadId + dateTime.ToString("MM-dd-yyyy hh:mm") + securityGuid;
	var bytesForHash = Encoding.UTF8.GetBytes(stringToHash);
	var hash = sha.ComputeHash(bytesForHash);

	return Convert.ToBase64String(hash);
}