Secure File Sharing App in Golang (The Concept)

Photo by Markus Spiske on Unsplash

Let’s build a simple file drop application to send files to other people. The application should be very simple:

• Drop a file in a webpage
• Get a shareable link
• Someone else uses the link to download the file
• Delete the file after it is downloaded from the server

So where is the “secure” part?

We will take care of this part using a couple of things:

• We will surely use SSL
• Encrypt the files while they are on the server using a random key
• Don’t keep the key of the server

The process of sending the file

1. Once a file is uploaded, we a generate a random base64 string which is 24 letters. This is our encryption key.
2. Use AES to encrypt the file using the encryption key ENCRYPTION_KEY.
3. Hash the the encryption key using SHA-512. This is the storage key STORAGE_KEY.
4. Save two files under a folder named using the storage key: /files/{STORAGE_KEY}/content and files/{STORAGE_KEY}/name
5. content contains the content of the file encrypted using the encryption key. name contains the file name encrypted using the same encryption key.
6. Give a sharing link to the file sender that looks like: https://exmaple.com/{ENCRYPTION_KEY}

This will ensure that the server will contain the file and the file name in an encrypted form. At the same time the server will not know what is the encryption key.

The process of receiving the file

1. Once the server receives a request to download a file, the server will receive the the encryption key and hash it to find the storage key.
2. Using the storage key, the server can find the file content and file name and decrypt both of them.
3. The server sends the file to the user decrypted and named using the original file name.
4. Overwrite the file many times to ensure the original content is net recoverable.
5. Delete the file.