Restrictions for private link
under review
Vaishnave Jayaraman
When dealing with articles that contain confidential or sensitive information, ensuring controlled access is critical. Currently, if an editor generates a private link using the "Share Link" option, this link can be accessed by anyone who has it, potentially exposing the content to unintended viewers.
To enhance privacy and security, it is essential to introduce restrictions on who can generate these private links. Customers should have the ability to configure role-based permissions, ensuring that only authorized users, such as admins or designated roles can create shareable links.
Additionally, a built-in expiration mechanism should be implemented for these links. By setting a timeout for automatic expiry, owners of the project can minimize the risk of unauthorized access over time. This ensures that confidential information does not remain accessible indefinitely
Log In
Ed Hawco
I have several comments about this.
First: regarding expiry of the link, this should be OPTIONAL. In my use case, I have a number of articles that I do not want to have included in the KB's table of contents and are readable by private link only. These are published, stable articles intended for a small long-term audience. If those links expire on a timer, it means I need to KEEP TRACK of all those links and refresh them (and inform the users) every time they expire. This is a burden I do not want to endure. If making the expiry were optional, then I could continue using the feature as-is, without worry.
Second: a larger problem with this private link mechanism is that the article does not even need to be published for the private link to work. This means that if I share a private link to an article with customers, and later decide to update the article, those customers will see my DRAFT and un-reviewed versions as I am working on the update. This is really, really bad, and it essentially spoils my use case for this feature.
RECOMMENDATION 1: Since the article needs to be HIDDEN to use the private link, I think it makes sense that the private link only shows the PUBLISHED BUT HIDDEN version of the article. That way, I can work on the article in DRAFT mode without viewers seeing the in-progress update. The draft content would not be visible via the private link until the hidden article is published.
I realize that this promotes my use case while killing the use case of using private links to share draft versions for review. Personally, I don't think that's a good way to review articles, but obviously I have a bias. The Document360 team needs to determine which use case is the preferred one and design the feature to work with that one.
RECOMMENDATION 2: Alternatively (and preferably) design TWO ways of sharing hidden/unpublished pages. For example:
PRIVATE LINK: Works as suggested above; shows PUBLISHED but HIDDEN articles, but does not show DRAFT versions in progress. This is for the use case of allowing PRIVATE PUBLISHED articles that do not appear in Search or on the KB's table of contents.
REVIEW LINK: Temporary private link that shows the DRAFT version of an article, whether or not the article is HIDDEN. This would only be used for the use case of reviewing draft content.
D
D360 Product Management
under review
Mohamed Shakheen
Hi Steph We completely understand the need for stricter control over who can generate shareable links, as well as the importance of having an expiration mechanism to limit long-term access. Introducing role-based permissions and link expiry would certainly enhance both privacy and security in such scenarios.
We’ve noted your suggestions and will keep them under review as we evaluate potential enhancements in this area. If this is picked for our roadmap, we’ll be sure to keep you updated on the progress.
We appreciate your continued feedback - it helps us make Document360 better for everyone.
Steph Morgan
The most important element is the privacy side of things, so another useful option would be the ability to lock down by default who links can be shared with - options like: only registered users of the site, only users who would be able to access the article once published, only specified users, all, etc.
Vaishnave Jayaraman
Adding Steph to track the progress.