How can I create a secured file upload page on a website?
I'm creating a landing page where folks can upload their sales compensation/sales employment contract for review by legal professionals as a free service to help increase access to justice or ensure sales people aren't getting screwed in the start-up world.
I need help figuring out how I can create a secured file uploading/sharing functionality on the page similar to levels.fyi
help?
Hi Omar, hope you are well! BlockSurvey(https://blocksurvey.io) has a fileupload component. You can embed the form or add widgets to collect files. It is end to end encrypted and only you can access it. For sharing, you can look at http://envelop.app/.
Very cool solution(s) for those looking for high security.
Hey Omar, thats a tough question because it really depends how deep you want to go down the rabbit hole of information security. You might need an extremely robust system in place if you truly want to a secure web application on par with what people rightfully expect nowadays.
I would say besides how secure you want to be, the other question would be what existing stack are you using. Frameworks like Django have things like file/media storage built in.
Probably the easiest thing to do would be to use a third part widget or link that enables uploads to an already built out platform like Box, GDrive, etc.
Like this one:
https://support.box.com/hc/en-us/articles/360045304613-Introducing-Box-File-Request
That being said please make sure your website uses at least TLS 1.2+ and probably use a web application firewall.
Just FYI, PDFs which it looks like you are asking people to upload, are a very common attack vector. Give some thought to that as well.
Some developers are going to look at this post and be like this guy is paranoid just slap BS together and let people send you stuff.
But they're wrong!
Don't listen to them- security and privacy are important. People are counting on us to not screw this up. You're going to ask people to upload this personal W2s and other documents. Building fast and lean doesn't mean completely ignoring people's security and privacy. I know you're not doing that because you're asking the right question.
Good luck and I'd be happy to help out if you need it!
This is great -- thank you!
It's not a start-up or a business. I just want to create a social good project. Happy to get help.
It's just a landing page with a secure form/file share.
Also, I'm not a developer just in case you thought I was.
Nice, what do you plan to use to make the landing page?
Upload your images to Amazon S3, serve them via cloudfront (CDN) and restrict bucket access so that only the CDN can read from the bucket.
If you have more secure images (sensitive user documents for example), you can lock public bucket access down completely, upload them to S3 and and read them via a signed URL that expires after like 15 minutes.
Your API will use the aws SDK to generate the signed URL.
Hope this helps, lol.
Hey Omar, if you're not a developer and you're just looking for reasonable security/best practices, I'd suggest you look at Zoho Creator, their low-code platform (or possibly a Zoho One subscription, as you might want to combine it with their CRM and/or Flow apps. Zoho is generally pretty good around security/privacy.
Not free but pretty cheap, and I don't think there are any free solutions that will get a non-developer where they want to be.
Hey Omar, it might be good to also consider ways that wouldn't make your website responsible for securing and hosting this sensitive data. Maybe be the tool that connects the parties and then they can share data directly, outside of your platform or they can share in methods they already consider safe (Google Drive, S3, email...)