Skip to content
GitLab

User file uploads (FREE)

  • Enforced authorization checks introduced in GitLab 14.8 with a flag named enforce_auth_checks_on_uploads. Disabled by default.
  • Enforced authorization checks became generally available in GitLab 15.3. Feature flag enforce_auth_checks_on_uploads removed.
  • Project settings in the user interface introduced in GitLab 15.3.

In private or internal projects, GitLab restricts access to uploaded files (such as PDFs) to authenticated users only. By default, image files are not subject to the same restriction, and unauthenticated users can use the URL to view the file. If you enable authorization checks for all media files, images receive the same protection and are viewable only by authenticated users.

Users can upload files to issues, merge requests, or comments in a project. Direct URLs to these images in GitLab contain a random 32-character ID to help prevent unauthorized users from guessing image URLs. This randomization provides some protection if an image contains sensitive information.

Authentication checks for images can cause display issues in the body of notification emails. Emails are frequently read from clients (such as Outlook, Apple Mail, or your mobile device) not authenticated with GitLab. Images in emails appear broken and unavailable if the client is not authorized to GitLab.

Enable authorization checks for all media files

Non-image attachments (including PDFs) always require authentication to be viewed. You can use this setting to extend this protection to image files.

Prerequisite:

  • You must have the Maintainer or Owner role for the project.
  • Your project visibility settings must be Private or Internal.

To configure authentication settings for all media files:

  1. On the top bar, select Main menu > Projects and find your project.
  2. On the left sidebar, select Settings > General.
  3. Expand Visibility, project features, permissions.
  4. Scroll to Project visibility and select Require authentication to view media files. You cannot select this option for projects with Public visibility.