Wirebook › Bonus lesson

I changed who can open my link. Does the old link still work?

Bonus lesson · about 7 minutes · hands-on · nothing you type leaves your browser

You share a drawing with a link. Later you change your mind about who should see it. Does the old link stop working? Can you take the picture back from someone who already saw it? Play the guard at the door with pretend visitors, take badges away, make a new link, and find out what a website can and can't undo.

Why the old link can stop working

A link is just an address. It doesn't carry the picture inside it, and it doesn't carry permission either. Each time someone opens it, their browser sends a fresh request, and the server decides then and there whether to answer. So when you change the rules, the very next visit gets the new answer. That's why the guard in the game checks every visit, not just the first one.

• People on a list. The visitor has to sign in, so the server knows who they are (that part is called authentication). Then it checks whether that person is on the list (that's authorization). Take someone off and their next visit is refused with 403 Forbidden. Not signed in at all? That's 401: “show your badge first”.
• Anyone with the link. Here the link itself is the key: a long random code nobody could guess. The server doesn't ask who you are, so a forwarded link works for a stranger too. To stop it, you revoke it: the server forgets that code, and every copy of the old link now leads nowhere (often a 404). Then you send a new link only to the people you still want.
• Only me. Everyone else is refused, even people who had a badge or a link before.

Sneaky leftovers grown-up websites watch for

• Old copies on the way. Browsers and networks keep cached copies to save time. A private picture should be sent with Cache-Control: private, no-store so no shared shelf keeps one after access is taken away.
• Links that never expire. Many apps let a share link run out after a day or a week, so forgotten links can't leak later.
• Already signed in. A good app checks the list on every request, not only when someone signs in, otherwise a removed person could keep using a session that started earlier.
• “View only” isn't “can't copy”. Anything that appears on a screen can be photographed. View-only stops the easy download button, not a determined copier.

Grown-up twins: Tooltern's help pages on 401 vs 403 and no-cache vs no-store, plus why a removed person can still see a file, building share links you can revoke and why a presigned storage link has no off switch. Fusenote's one-time notes work like a link that revokes itself after the first visit: still, whoever opened it could have copied what they read.