Volto - Lead Image of private content is not shown in block for authenticated

sneridagh · May 27, 2022, 1:26pm

Thanks for the info. Yes, as @tiberiuichim mentioned, there's some magic at work at the SSR node server level. A special route is in place intercepting @@images and @@download:

github.com

plone/volto/blob/8ec87ff0c65a6ebc706a5bad70e68aba7d14cab9/src/express-middleware/images.js#L7

      
        
            import express from 'express';
            import { getAPIResourceWithAuth } from '@plone/volto/helpers';
            
            
const HEADERS = ['content-type', 'content-disposition', 'cache-control'];
            
            
function imageMiddleware(req, res, next) {
              getAPIResourceWithAuth(req)
                .then((resource) => {
                  // Just forward the headers that we need
                  HEADERS.forEach((header) => {
                    if (resource.headers[header]) {
                      res.set(header, resource.headers[header]);
                    }
                  });
                  res.send(resource.body);
                })
                .catch(next);

The SSR server injects the auth_token information in an inner request from SSR to Plone then returns the resultant image. All images and files work using it, to overcome the private images use case, since HTML src and href attributes can't inject the token in the bare requests made by the browser. This is working since the very beginning of Volto.

Thanks for the pointer! And, thanks a lot for digging and getting this fixed! Sorry for not having the time to take a look into it or investigate further.