ALLOW_UNAUTHENTICATED in production

[skiunke]

The documentation clearly states that ALLOW_UNAUTHENTICATED should not be used in production on a non localhost server. What's the exact reason for this? File safety reasons or access control?

[Xenthys]

TL;DR: both, it's probably even more dangerous than most people may assume.

_{Disclaimer: the following explanation is simplified for all readers, it may not address everything that should be taken into account.}

---

This is a general recommendation to avoid it, unless you really know what you are doing.
Allowing anyone to register an account comes with the same recommendation, for the same reasons.

In most cases, these options would allow everyone to use your public instance, raising two major issues:

• Malformed or specially crafted files may trigger a converter vulnerability, which could lead to denial of service and/or remote code execution depending on the context. The latter would allow an attacker to perform data exfiltration.
• Malicious actors can use scripts to upload many files, which could both overload your resources (CPU, RAM, storage) and make you store arbitrary content that may be illegal in your country.

Since this project depends on a lot of third-party software to convert files, it only takes one vulnerability to be found in any of them to represent a high risk for all running instances.

Even if you put that risk aside and keep UNAUTHENTICATED_USER_SHARING disabled, to prevent your instance from being usable as a public file server allowing anonymous uploads, it will not be sustainable as soon as bots and random users find it. This isn't a matter of "if" but "when" that event will happen, at which point you would have to react.

Note that ConvertX receives and serves converted files as-is, without encrypting them on your local storage. It also doesn't come with Terms of Service nor a Privacy Policy attached. While this isn't a technical issue, depending on the applicable laws in your local jurisdiction, properly hosting it as a public service may require a custom adaptation.