private_file_token

Provides access to private files and images by injecting authentication token with a timestamp into their urls. Such a token will be validated when such url is accessed and in case of successful validation the access will be granted. Token is valid for certain period of time.

The intended use case is for decoupled sites which relies on non-cookie authentication. For example when the site uses JWT header authentication. Without a cookie the private files or images cannot be accessed because no form of authentication has been provided (the cookie is missing). This module solves this problem by introducing authentication via token, which is valid for a configurable amount of time.

Example of a private image url containing authentication token and timestamp:

https://example.site/system/files/styles/thumbnail/private/resume/photo/profile_image.png?token=rEezZ9fNlupFtiWb98lJlwct4jFz96987uJovl_c_Zs&timestamp=1605024462&itok=NxuIebsw

Token will be validated along with the timestamp and the path part of the image url. Parameter itok still exists in the url as it is required by Drupal to actually generate image style of the image.