[ARCHIVED] Files Only available to students with link, not really safe?

[ido-nl]

Hi,

I have restricted folder + file access by using the option "Only available to students with link". So the whole folder including files are hidden for the student.

I have added one of the restricted files in my content, the student can open this file without any problem. 

But now my problem, its not very difficult for the student to guess the links for the other restricted files.

The link to the file is /courses/14639/files/43207530?wrap=1

but I can just try other id's, like /courses/14639/files/43207531?wrap=1  and 43207532 etc to open all the other files. When uploaded all together, all the id's are sequential.

Are there safer ways?

kind regards

Ido

[kmeeusen]

Hi @ido-nl 

While I have never worried about the security of my files, here is what I do..........

• Hide the Files content area

  How do I manage Course Navigation links?

• Organize my content into Modules

  How do I add course content as module items?

• Set my modules so that students have to work through the content sequentially (I seldom do this, but it keeps students for seeing content item #2 until after viewing content item #1)

  How do I add requirements to a module?

It makes it  much less obvious where the files come from, and how Canvas has numbered them, and the next sequential file number is useless  because Canvas won't let them navigate to it. It is challenging in Canvas to make student-centered content entirely inaccessible except by unpublishing it.

You can learn more about organizing files at Share UDL Course Design Tips, Tricks and Techniques.

I hope this helps,

Kelley

 

[ido-nl]

Hi Kelley,

Thank you for your reply. It makes sense separating the files into modules. So if a module is not accessible yet, the files also wont be.

But within a module, hiding the files would be difficult.

What I would like to achieve, is have personalized files. Eg. Student 1 sees file 1, student 2 sees file 2, etc.
I want to create an LTI application to only show the student's file when a student views the page. Of course the filename should contain the student number.

This trick could work, but not when uploading all the files at once and students can just change the link.

Creating a module per student is also not really an option, there are about 1000 students.

[willmoin]

This is good discussion. In our case we're looking to help lecturers who are looking to have attachments on assignments. The assignments have availability dates but the 'anyone with link' approach doesn't seem very secure in this context for these types of reasons. In our case I think we'll have to set an availability date on the file as well