DEV Community

Discussion on: How do "public but secret" URLs work

Collapse
 
nektro profile image
Meghan (she/her)

There are a number of ways to hide content but what I believe dev.to does is that when you save a post but don’t publish it generates a proper post url but it doesn’t add it to the homepage queue of posts. So people can still view the post if you give them the direct url but it won’t show up in any feeds

Collapse
 
kataras profile image
Gerasimos (Makis) Maropoulos

I believe that they have a field somewhere like "public" 0 for false(private) 1 for true(public) and on internal fetch of the articles if '0' then just skip that and don't add it to the list, whatever article list is that, except when the user sees his own profile, so the author_id is the same as the logged in user, then it fetches it and client-side can generate a url based on the title, the time and the author, no need to be a true URL link if not published. However I don't know how dev.to works internally but I assume this is a good and secure solution, so no one can see the link of private/unpublished article because it doesn't exists yet.

Collapse
 
ben profile image
Ben Halpern

Yep, the obfuscated URL is basically the password. It's completely private if you never give it out. Otyer services do this. If I recall correctly, Craigslist even let's you edit posts this way.

Collapse
 
aurelkurtula profile image
aurel kurtula

But would it not be visible to search engine crawler and found that way? Is there something stoping the crawlers, or that's not how they work.

Thread Thread
 
nektro profile image
Meghan (she/her) • Edited

1) Search engine crawlers only follow links, which there are none unless the OP puts them out there,

2) and you could also have server code that is something along the lines of

if (header('User-Agent').indexOf('Bot') > 0) {
    // respond with blank or 404
}