2019-09-04 21:01:54 +05:30
---
type: reference
2020-10-24 23:57:45 +05:30
stage: Manage
2022-04-04 11:22:00 +05:30
group: Authentication and Authorization
2021-02-22 17:27:13 +05:30
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2019-09-04 21:01:54 +05:30
---
2019-09-30 21:07:59 +05:30
2021-11-18 22:05:49 +05:30
# User File Uploads **(FREE)**
2015-12-23 02:04:40 +05:30
2022-04-04 11:22:00 +05:30
> - In GitLab 14.8 and later, [authorization checks are enforced](https://gitlab.com/gitlab-org/gitlab/-/issues/26781) on media uploads. This change is being [rolled out incrementally](https://gitlab.com/gitlab-org/gitlab/-/issues/352291) on GitLab.com in 14.9.
2019-09-04 21:01:54 +05:30
Images that are attached to issues, merge requests, or comments
do not require authentication to be viewed if they are accessed directly by URL.
This direct URL contains a random 32-character ID that prevents unauthorized
people from guessing the URL for an image, thus there is some protection if an
image contains sensitive information.
2015-12-23 02:04:40 +05:30
2019-09-04 21:01:54 +05:30
Authentication is not enabled because images must be visible in the body of
notification emails, which are often read from email clients that are not
authenticated with GitLab, such as Outlook, Apple Mail, or the Mail app on your
2019-09-30 21:07:59 +05:30
mobile device.
2019-09-04 21:01:54 +05:30
2021-02-22 17:27:13 +05:30
NOTE:
2019-09-04 21:01:54 +05:30
Non-image attachments do require authentication to be viewed.
<!-- ## Troubleshooting
Include any troubleshooting steps that you can foresee. If you know beforehand what issues
one might have when setting this up, or when something is changed, or on upgrading, it's
important to describe those, too. Think of things that may go wrong and include them here.
This is important to minimize requests for support, and to avoid doc comments with
questions that you know someone might ask.
Each scenario can be a third-level heading, e.g. `### Getting error message X` .
If you have none to add when creating a doc, leave this section in place
but commented out to help encourage others to add to it in the future. -->
