{"id":22249,"date":"2020-12-17T16:02:03","date_gmt":"2020-12-17T16:02:03","guid":{"rendered":"http:\/\/user_generated_content_part_4_security"},"modified":"2024-10-03T15:17:40","modified_gmt":"2024-10-03T22:17:40","slug":"user_generated_content_part_4_security","status":"publish","type":"post","link":"https:\/\/cloudinary.com\/blog\/user_generated_content_part_4_security","title":{"rendered":"User-Generated Content, Part 4: Security"},"content":{"rendered":"

Part 1<\/a> of this series highlights the basics of user-generated content (UGC) and its benefits for e-commerce. Part 2<\/a> describes how to leverage UGC images in e-commerce<\/a> and efficiently upload, transform, and deliver them with Cloudinary. Part 3<\/a> focuses on videos in UGC and the many related management capabilities offered by Cloudinary.<\/p>\n

Part 4 here suggests ways of rendering UGC media securely and free of harmful or inappropriate material, in particular by leveraging two configurations and an add-on in Cloudinary.<\/p>\n

Why is Important to Render UGC Media Safely<\/h2>\n

Site owners rightly assume that all UGC uploaded to their system originates from their users. Inevitably, however, with the ability for anyone to upload content to a site, others might want to see how much they can get away with, like large amounts of assets that overwhelm your system, files with embedded code, or, even worse, assets that contain malicious content. Regardless, you must take precautions against those misdeeds.<\/p>\n

You can set up your system in many ways to handle your unique UGC workflow. In this case, a wise practice is to never<\/strong> serve on your site or app the original\u2014that is, unprocessed\u2014assets uploaded as UGC to avoid unknowingly delivering malicious content, which could have serious ramifications, typically leading to unwanted, adverse publicity.<\/p>\n

What should you serve instead? A dynamic media platform like Cloudinary<\/a> can help because it automatically processes all your non-original images and videos<\/a> (aka transformed assets), ensuring that they are optimized and malware free. To apply this set of actions, all you have to do is simply apply any type of transformation through Cloudinary. Whether it be setting a crop mode, width, format, etc. all will lead to the processing of your asset.<\/p>\n

How to Do It with Cloudinary<\/h2>\n

Avoid serving original assets and set up more stringent security settings with Cloudinary, by doing the following:<\/p>\n

    \n
  1. \n

    Set the asset\u2019s type<\/code> parameter to private<\/code><\/a> in the upload to make the original asset private, i.e., invisible, to the public, allowing them to view the asset\u2019s derivatives only. To view the original asset, one must have a signature-generated URL. (If you\u2019ve already uploaded the asset, you can update it; see the related documentation<\/a> for the procedure)<\/p>\n

    Additionally, you can gain even more granular access to private asset-security measures with the following step:<\/p>\n<\/li>\n

  2. \n

    Enable the Strict Transformations setting<\/a> to specify which derivatives (e.g., thumbnails) are viewable or allowed to be generated by anyone without the signature-generated URL.<\/p>\n<\/li>\n<\/ol>\n

    Bear in mind it\u2019s best to ensure security of your UGC not only for your business, but also for others. Inevitably, users might accidentally upload assets that expose private information about themselves or that include visuals of people who would balk at a public posting of their pictures. To alleviate those situations, here are some workflows to keep in mind:<\/p>\n