# "Secured" Assets URL **URL:** \ **Category:** Ideas and Feature Requests\ **Created:** [February 25, 2018, 2:39pm UTC](https://forum.mautic.org/t/secured-assets-url/10266 "2018-02-25T14:39:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Yannick038](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/yannick038/32/117_2.png) [@Yannick038](https://forum.mautic.org/u/Yannick038)\ **Post date:** [February 25, 2018, 2:39pm UTC](https://forum.mautic.org/t/secured-assets-url/10266/1 "2018-02-25T14:39:09Z")
Originally posted on github : [https://github.com/mautic/mautic/issues/5052](https://github.com/mautic/mautic/issues/5052) When creating an asset, the download URL generated by Mautic is : [https://mautic.company.com/asset/1:internal-id-of-asset](https://mautic.company.com/asset/1:internal-id-of-asset) Customers asked us why the internal id was facing the public url generated. We thought it was for security concerns : maybe mautic would check that both internal-id and numeric id match before processing the download but not as soon as you type in URL [https://mautic.company.com/asset/1:any-string](https://mautic.company.com/asset/1:any-string) the download is processed This way, a competitor knowing that you’re using Mautic could request all the assets by creating a single batch to loop accross all numeric Ids. I think mautic should implement a URL verification for both the numeric id and internal name provided. If the internal name does’nt match the numeric ID, download should be forbidden. Ps : maybe we should lock internal-id modification once the asset has already been created (like for custom fields) Any feedback from the communauty ? ---
**Author:** ![silavapi](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/silavapi/32/7424_2.png) [@silavapi](https://forum.mautic.org/u/silavapi)\ **Post date:** [October 17, 2019, 4:34pm UTC](https://forum.mautic.org/t/secured-assets-url/10266/2 "2019-10-17T16:34:35Z")