Share Links aren't 100% public?

[bn-c]

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

• Yes

The bug

What I am trying to achieve

• Current Setup: Self Hosted Immich, tunneled through Cloudflare and using ZeroTrust application to authenticate users.
• Goal: Exposing / Setting a Bypass on <immich-domain>/share to allow un-verified access from public internet to generated share links

Presumed issues

I'm not familiar with the inner working of Immich, but I am assuming that /share/<key> page isn't generated and served under the share path but it contains references to other paths / resources.

• Is there another path that would be required, but safe to expose to the public internet?
• Why can't public share be contained in /share/ ?

The OS that Immich Server is running on

Nixos 24.11

Version of Immich Server

v1.132.3

Version of Immich Mobile App

N/A

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

N/A Using nix service to setup my immich.
  services.immich = {
    enable = true;
    package = pkgs.unstable.immich;
  };

Your .env content

N/A

Reproduction steps

1. Login to Cloudflare, access Immich as a registered user
2. Create a share link
3. Try to access that share link from an un-authenticated session / machine

Relevant log output

Additional information

No response

[mmomjian]

There are many paths that are required to view a shared link. Best approach would be trial and error using the browser console, or use something like Immich Public Proxy which is designed for this purpose.

[bn-c]

Thanks a lot for the quick reply. Immich Public Proxy wasn't on my radar, and going to try it asap!

Otherwise, trying to expand the permission is neither ergonomic on Cloudflare - requiring new application instances for each path/subpath, nor best practice (IMO), considering how Immich is in active development and API changes can come at anytime.

[mmomjian]

Sure, good luck. Ultimately how you choose to expose / publish immich is up to you. :) we don’t offer any endpoints that are “sanitized” or encapsulated.

[bn-c]

I have tried out the Immich Public Proxy, and it worked!

Had a few pet peeves like

• How it uses a different Image viewer than Immich, so there is a chance for theme-drifting
• Requires a different subdomain and setting of global External domain in Immich to support copy & paste.

Makes me wonder if this would have been implemented cleaner as a plugin? Although I'm pretty sure Immich don't support plugins atm.