Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I was browsing pictures of a friend on Facebook. This friend has their privacy settings configured so that you have to be a friend to view them. I'm not able to share them, and even if I open a pic, copy the URL from the address bar, and share it with someone who is not their friend, they're unable to view it.

However, I found a flaw in that routine. If you open up such a picture just the same, then right-click the picture and choose "Copy Image URL" (may differ depending on browser), and share that copied URL, then other non-friends are able to view it.

Is this supposed to be possible? Or is this a security breach in Facebook?

EDIT

To be more specific, when I copy the image URL from the address bar, I get...

https://www.facebook.com/photo.php?fbid=xxxxxxxxxxxxxxxx

However, when right-clicking the picture and copying the image URL, I get...

https://scontent-b.xx.fbcdn.net/xxxxxxxxxxxxxxx
share|improve this question

2 Answers 2

Yes it's supposed to be possible. Since the URL is a .jpg (e.g. https://scontent-a.xx.fbcdn.net/hphotos-ash4/309_60979110450_4203_n.jpg), you cannot filter its access based on your browser session.

Google+ pictures have the same behavior for instance. Here is a private photo in one of my G+ albums: https://lh3.googleusercontent.com/-LupTZHNd7bk/UkeMt9ANyvI/AAAAAAAApfI/9vCnBldf6UM/w1289-h967-no/20130928_221255.jpg

Gmail pictures are however really private. Notice the difference in the URL: https://mail.google.com/mail/u/0/?ui=2&ik=9b35d04bc1&view=att&th=1415c0ae407284ad&attid=0.1&disp=emb&realattid=ii_1415c0ac0763e031&zw&atsh=1

share|improve this answer

It has to do with the way the respective application (Facebook in this case) works. Meaning that the pictures can be presented to the browser directly (i.e. using their HDD physical URL—your second URL example) or through a page/script that masks the physical location, as in your first URL example. So no, it’s not a flaw, it has more to do with speed and other things, as it’s easier (and faster) to point directly to the physical location of the respective file than to “form” it through a script.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.