[BUG]: Images in shared notes do not load

[argueta-xyz]

Describe the bug

Adding an image in a publicly shared note causes the image to be 401'd as it tries to access the /api/image/$USER/$IMAGE_FILE without any authentication.

Steps to Reproduce

1. Create a note
2. Add an image
3. Share note publicly
4. Open public share URL in incognito browser
5. Note loads, without image.

How do you run Jotty?

Docker

Jotty Version

1.21.1

Checklist

• I have searched across other issues to make sure this bug has not been already reported.

[fccview]

Hey,
In order to publicly show images and files you'll need to add the right env variables for it, it's a security measure.

Please check the howto env section ♥️
Lemme know if you need any help and feel free to close this if it works

[argueta-xyz]

Hey,
Appreciate the quick response! So while that works, it has the unintended side effect of making ALL images publicly accessible.

Tested once by adding image to publicly shared note, and it worked.
Tested by adding a different image to private note, and the URL https://[SERVER]/api/image/[USER]/private_image.png is still accessible in a completely different browser in incognito mode.

Obviously this is a security risk, so I'll just leave the sharing env's disabled for now.

Motivation: Want to use public notes as README's for users on my domain, but don't want to share everything or allow logins.
Ideally, publicly shared resources would all have sources symlinked under domain.com/public/[note|image|file] and allow a firewall to just whitelist /public

[fccview]

Yes I am aware of that, which is why I made it a user choice.

Unfortunately in an environment where data is stored on the system having symlinks is a huge security risk, so I have been avoiding using them until it'll be absolutely necessary.

I am not sure yet on what a solution for this could be, maybe a prefix for public images names public-<image_name> could be a solution

[argueta-xyz]

Gotcha, user error - if I stopped to read the description I would have seen that, although tbh the variable name can be a bit misleading ( SERVE PUBLIC IMAGES vs SERVE ALL IMAGES PUBLICLY ). I think I misspoke, given they the same note is visible at /public/note/random-id and /note/category/human-filename, there might be a way to create routes for images found in public notes but that would require having a database and a live modification of embedded links, so definitely not trivial. Anyway, not a huge priority, just giving unsolicited thoughts.

…

On Thu, Mar 26, 2026 at 1:48 AM fccview ***@***.***> wrote: *fccview* left a comment (fccview/jotty#466) <#466 (comment)> Yes I am aware of that, which is why I made it a user choice. Unfortunately in an environment where data is stored on the system having symlinks is a huge security risk, so I have been avoiding using them until it'll be absolutely necessary. I am not sure yet on what a solution for this could be, maybe a prefix for public images names public-<image_name> could be a solution — Reply to this email directly, view it on GitHub <#466?email_source=notifications&email_token=AHWD2DXXAGSHUYGH3YG4PHL4STVEXA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJTGI3TKNRVGQ4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4132756548>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHWD2DSKOBQDOYVWQZD6F734STVEXAVCNFSM6AAAAACW4WUAHSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCMZSG42TMNJUHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>