Treat Sharing Links as Bearer Capabilities

Model anonymous links as bearer capabilities

An anonymous sharing link is a bearer capability: possession grants its authority. Store a hash of a random token with resource, action, expiry, creator, and status; do not treat unguessability as protection from forwarding. RFC 6750 Bearer Token Usage supplies the primary specification or operating model for this decision.

Separate preview and download authority

A preview link may allow read-only rendering for seven days while a download grant is separate. Remove tokens from history after redemption and prevent analytics, logs, referrers, support tools, and third-party page resources from receiving them. Google Drive sharing guide provides the complementary protocol or operational detail.

Minimize the capability

Generate enough random token material, store only a hash, and bind the record to resource, allowed action, creator, expiry, and status. Separate preview from download if those actions have different risk. A token in the URL can leak through history, logs, referrers, analytics, screenshots, and forwarded messages, so keep third-party resources off the redemption page and remove the token from the address after exchange.

Recipient-bound links should require the intended identity in addition to possession. Anonymous links should be presented honestly as transferable bearer authority.

Make visits safe and revocation observable

Email scanners and preview bots may follow GET links. A GET can render a non-sensitive confirmation, while a deliberate POST or subsequent authenticated action performs mutation. Use one-time consumption only when the user experience can tolerate scanner and retry behavior.

Owners need a list of active links with scope, creation, expiry, and last use, plus immediate revocation and rotation. Test a forwarded link, expired link, concurrent redemption, revoked link behind a cache, and a page with an external analytics request. Start by tracing one current sharing URL through browser, CDN, logs, and support tooling; remove every location that records its raw token.