Assets Permissions

Hey all. I’ve noticed that even when an item in directus_files is not accessible via the public policy, if you have the ID of a file, you may access it at /assets/:id.

Is this intentional, or do I have an issue with my permissions? Public has no read permissions. I understand that a user wound have no access to the id in the first place without permissions, but that did not seem like a good reason to me for the file to be publicly accessible via /assets.

Thanks for any guidance!

By default nothing is accessible to the public or other users. You must have read permissions enabled for the public role through a policy somewhere in the system.