Share Links
A link that opens one document for somebody with no account — expiring, revocable and limited by number of uses.
Where to find it
On a document, the Sharing panel → Create link. The link is shown once and cannot be shown again.
Shown once, on purpose
Only a hash of the token is stored, so there is nothing to show you later. Copy it when you create it; if you lose it, revoke it and make another.
Three things checked before any bytes move
- Is the token real, unexpired and unspent?
- Is it for this purpose? A token minted to do something else must not open a document because somebody pointed it at this endpoint.
- Does the file it names belong to this document? Without that last check, a link to one document is a link to every file in the system by changing one number in the URL.
A use is consumed before the file is served
So a link with two uses is worth two downloads, whatever happens afterwards.
What minting refuses
- A document whose classification forbids export. “May be looked at, must not leave” — and a share link is the most complete way of leaving there is. Refused when you create the link, where you can do something about it, rather than at the door.
- A document that lives in a file store. The store has its own permissions resolved from the caller’s security groups, and a token holder has none. Adopting one file out of a store must not become a way round somebody’s decision about a whole library.
Downloads through a link are logged
As a link rather than as a person, because that is what is known. A link opened forty times from three countries is visible in the access log.
It is still the whole document
A link is not a redaction. Whoever has it has the file, including any version history the link exposes. For anything that needs less than the whole document, send an extract.
Worked example
A surveyor with no account needs the site plan. A link is created with a seven-day expiry and two uses, pasted into an e-mail, and forgotten about. It stops working on its own, the access log shows it was used once, and nobody had to create an account or remember to tidy up.
Recommendations
- Shortest expiry that works. A week is generous.
- Few uses. One or two covers a genuine recipient and not a forwarded e-mail.
- Revoke when the job is done rather than waiting for the expiry.
- Check the access log if the number of uses looks wrong.