# ActiveStorage defaults to security via obscurity approach to serving links # If this is acceptable for your use case then this authenticable test can be # removed. If not then code should be added to only serve files appropriately. # https://edgeguides.rubyonrails.org/active_storage_overview.html#proxy-mode def authenticated? raise StandardError.new "No authentication is configured for ActiveStorage" end

I think this is important, and I'd love to help making ActiveStorage a more secure place.

Highly Secure by Default

Data that is sent over the network is compressed (optionally) and encrypted (always). When receiving data it must be decrypted and then (if compressed) decompressed.

While there are security benefits to disallowing unsigned extensions by default, it is not clear why there is no option to turn off this behavior, perhaps by making it configurable only with administrator rights.