# Web Asset Server request user identification **URL:** \ **Category:** Get Help\ **Created:** [August 29, 2025, 11:03am UTC](https://speciforum.org/t/web-asset-server-request-user-identification/2811 "2025-08-29T11:03:29Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![fedoras](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/fedoras/32/455_2.png) [@fedoras](https://speciforum.org/u/fedoras)\ **Post date:** [August 29, 2025, 11:03am UTC](https://speciforum.org/t/web-asset-server-request-user-identification/2811/1 "2025-08-29T11:03:29Z")
In extension to below information, we have some related questions, springing from my colleagues’ attempts to create a replacement for the web asset server: > [@How to enumerate user permissions from API](https://speciforum.org/t/how-to-enumerate-user-permissions-from-api/2742/2): > > Hi @fedoras, I was on vacation, apologies for the late reply. In Specify 7, there are different tables that capture the complete picture of a particular user’s permissions: Table Name Role spuserpolicy Stores individual user policies (collection-scoped or global). spuserrole Associates Specify users with roles. sprole Defines roles at the collection and institution level (group of policies). sprolepolicy Stores policies attached to each role (collection-scoped or global). The… 1. When a request to view an attachment is sent to the web asset server, it does not contain any token with information on the user making the request. Without this, we can’t use the permissions information to decide whether to serve the asset or not. How would we possibly be able to get this kind of information? In other words, is there anything in the headers being passed that can be used to identify the user session? 2. Can we perhaps use the audit log or some other log to determine the user making a request? ---
**Author:** ![jason\_m](https://avatars.discourse-cdn.com/v4/letter/j/8e8cbc/32.png) [@jason\_m](https://speciforum.org/u/jason_m)\ **Post date:** [September 16, 2025, 6:53pm UTC](https://speciforum.org/t/web-asset-server-request-user-identification/2811/2 "2025-09-16T18:53:05Z")
Hello @fedoras! I imagine you wish to house some sensitive attachments on the Web Asset Server that should only be accessible to some users? Unfortunately, there is not an easy way with the current Web Asset Server to facilitate user identification for GET requests (i.e., viewing an attachment); there inherently is no user-identifiable information expected in requests made to the Web Asset Server. I would imagine the closest thing the Web Asset Server natively has for this is the `REQUIRE_KEY_FOR_GET` setting, which if enabled universally requires GET requests to include a `token` parameter (similar to requests with side-effects). > Ultimately it depends on your security requirements, but if you are implementing your own asset server, or a middleware to sit “in-front” of the Web Asset Server and extend its functionality, then there may be some options available to you. Is the intuition behind utilizing the Audit Log to check whether the requesting user created (or modified) the associated attachment (and/or related record)? In theory, such an approach is possible (though might be susceptible to impersonation). Could you expand on this suggestion? If you are utilizing the Specify API, perhaps an implementation could leverage the session cookie set by Django’s [PermissionMiddleware](https://docs.djangoproject.com/en/4.2/topics/http/sessions/)? Each request made from an authenticated client will have a cookie (which [by default](https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-name) is called `sessionid`). Server-side, Django stores session information (like the logged-in user) within a session which uses the `sessionid` as an identifier. Naively, I would suggest a similar framework could be implemented in a replacement/middleware for the Web Asset Server: perhaps even directly using this `sessionid` in whichever implementation (though authentication might still be necessary to ensure the request(s) originated from a verified and authenticated Specify 7 API session). > Otherwise (or in conjunction with the previous suggestion), I would suggest utilizing a standard authentication approach with OAuth 2.0 and/or JSON Web Tokens. I’d be happy to discuss possible further implementation ideas! Are there any additional questions you have? ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex029/uploads/specifysoftware/original/2X/1/18a843c97bc32b40e8ad0e035755bc88ffaacaf7.svg) [@system](https://speciforum.org/u/system)\ **Post date:** [September 23, 2025, 8:09pm UTC](https://speciforum.org/t/web-asset-server-request-user-identification/2811/3 "2025-09-23T20:09:39Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.