No error when duplicating share link token

Hi there,

in the current release (32.0.6) it is possible to manually enter a token for the link of a share (custom permissions → share link token).

There seems to be no control for duplicates though. You can set the same token for as many shares as you want. In such cases, the first file is served.

It would be nice to either enforce uniqueness for the token or to show the list of shares with the token. The present situation is unsatisfactory…

Thx.

I agree that share tokens should be unique, so this is probably something that should be reported as an issue on GitHub, if it hasn’t been already: GitHub · Where software is built

However, I also think it shouldn’t be possible to customize share tokens in the first place. Once you allow that, they’re no longer really “tokens” anymore, because they become potentially easy to guess.

If it were up to me, I’d simply disable this feature entirely and thereby solve both problems in one go: the security concern and the possibility of having multiple identical links. :wink:

I find the tokens very useful because you can recreate links when the original share is lost for some reason.

Yes, we clearly see this very differently. :wink:

In fact, I’d go a step further and not only disable token customisation, but also limit the duration of public share links. If someone needs access again or for a longer period, simply send them a new link. If someone needs permanent access, creating a (guest) account would be the more appropriate solution.

That said, I do of course understand the convenience aspect of it. :wink:

Either way, this is probably not an issue that we’re going to resolve here. My recommendation would be to search GitHub for existing issues, and if you can’t find one, open a new one.