immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 13 Packages Projects Releases 10 Wiki Activity

[Feature]: Externally shared album to non-users (collaborative / non-collaborative) #112

New Issue
Closed
opened 2026-02-04 17:43:06 +03:00 by OVERLORD · 13 comments
OVERLORD commented 2026-02-04 17:43:06 +03:00
Owner
Copy Link

Originally created by @hugo-laestander on GitHub (Jun 25, 2022).

Originally assigned to: @alextran1502 on GitHub.

Feature detail

Often when a group of friends has done something together, they will have taken photos that the other people in the group would like to have. People want a quick and easy way to share the photos (without destroying the quality).

I think this would be a great feature for Immich to have, and as I see it, two options could be had:

  1. a combined shared album where everyone can contribute (collaborative),
  2. an album for only viewing and download (non-collaborative)

This might be the only shared album they will ever have access to. And neither me nor they want to make an account.

Therefore, I think it would be very good if they did not have to make accounts. The shared album could be done with a link and optionally a password.

Platform

Web

Originally created by @hugo-laestander on GitHub (Jun 25, 2022). Originally assigned to: @alextran1502 on GitHub. ### Feature detail Often when a group of friends has done something together, they will have taken photos that the other people in the group would like to have. People want a quick and easy way to share the photos (without destroying the quality). I think this would be a great feature for Immich to have, and as I see it, two options could be had: 1. a combined shared album where everyone can contribute (collaborative), 2. an album for only viewing and download (non-collaborative) This might be the only shared album they will ever have access to. And neither me nor they want to make an account. Therefore, I think it would be very good if they did not have to make accounts. The shared album could be done with a link and optionally a password. ### Platform Web
OVERLORD commented 2026-02-04 17:43:20 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Jun 25, 2022):

I think the album feature on the mobile app is serving what you are looking for, correct?

If so, it is just not being implemented on the web yet but the plan is in place.

@alextran1502 commented on GitHub (Jun 25, 2022): I think the album feature on the mobile app is serving what you are looking for, correct? If so, it is just not being implemented on the web yet but the plan is in place.
OVERLORD commented 2026-02-04 17:43:33 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Jun 25, 2022):

Ah I apologize, I misread the title. This is to share the album externally.

@alextran1502 commented on GitHub (Jun 25, 2022): Ah I apologize, I misread the title. This is to share the album externally.
OVERLORD commented 2026-02-04 17:43:38 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Jul 5, 2022):

On this feature, it might be nice if sharing links could be set to expire after a certain time, and to have a button to expire/revoke them manually.

@bo0tzz commented on GitHub (Jul 5, 2022): On this feature, it might be nice if sharing links could be set to expire after a certain time, and to have a button to expire/revoke them manually.
OVERLORD commented 2026-02-04 17:43:46 +03:00
Author
Owner
Copy Link

@danielyrovas commented on GitHub (Jul 30, 2022):

Also would love this feature. One less thing to use slow and clunky Nextcloud for.

@danielyrovas commented on GitHub (Jul 30, 2022): Also would love this feature. One less thing to use slow and clunky Nextcloud for.
OVERLORD commented 2026-02-04 17:44:02 +03:00
Author
Owner
Copy Link

@axgd-code commented on GitHub (Aug 12, 2022):

This could be a killer feature!

@axgd-code commented on GitHub (Aug 12, 2022): This could be a killer feature!
OVERLORD commented 2026-02-04 17:44:14 +03:00
Author
Owner
Copy Link

@matthinc commented on GitHub (Aug 13, 2022):

I really like the idea. We just briefly discussed this topic and decided to start by collecting requirements that will help us to choose an appropriate architecture as this feature will require major changes to Immich.
Please feel free to share your ideas as well, I will add them to the list.

  • As a logged in user, I want to share albums with users that don't have their own account.
  • As a logged in user, I want to set an expiration date to publicly shared albums
  • As the owner of a shared album, I want to add password protection to publicly shared albums to protect them from unintended access
  • As an external user viewing a publicly shared album, I want to upload my own assets to the album
  • As the owner of a shared album I want to revoke public access from shared albums
  • As an external user, I want to download assets from shared albums
  • As a logged in user, I want to track activity on my shared albums
  • As the owner of a shared album, I want to create multiple sharing links with different expiration dates
  • As the owner of a shared album, I want to review assets that were uploaded by external users before they appear publicly
  • As the owner of a shared album, I want to control the permissions of external users on this album (uploading, viewing, deleting)
  • As an external user, I want to be able to view a shared album on my mobile devices (responsive design)

As a first source of inspiration, I added a screenshot below that shows the sharing menu of a Nextcloud instance. I think they executed it rather well.

Image

@matthinc commented on GitHub (Aug 13, 2022): I really like the idea. We just briefly discussed this topic and decided to start by collecting requirements that will help us to choose an appropriate architecture as this feature will require major changes to Immich. Please feel free to share your ideas as well, I will add them to the list. - **As a logged in user, I want to share albums with users that don't have their own account.** - **As a logged in user, I want to set an expiration date to publicly shared albums** - As the owner of a shared album, I want to add password protection to publicly shared albums to protect them from unintended access - As an external user viewing a publicly shared album, I want to upload my own assets to the album - **As the owner of a shared album I want to revoke public access from shared albums** - **As an external user, I want to download assets from shared albums** - As a logged in user, I want to track activity on my shared albums - As the owner of a shared album, I want to create multiple sharing links with different expiration dates - As the owner of a shared album, I want to review assets that were uploaded by external users before they appear publicly - As the owner of a shared album, I want to control the permissions of external users on this album (uploading, viewing, deleting) - As an external user, I want to be able to view a shared album on my mobile devices (responsive design) As a first source of inspiration, I added a screenshot below that shows the sharing menu of a Nextcloud instance. I think they executed it rather well. ![Image](https://user-images.githubusercontent.com/6898797/184498627-82a10687-044a-4e6e-a660-f86332928c89.png)
OVERLORD commented 2026-02-04 17:44:18 +03:00
Author
Owner
Copy Link

@axgd-code commented on GitHub (Sep 7, 2022):

Another way to allow people to add some pictures is a public page just for the upload.
I prefer the implementation of Nextcloud because you specify the sharing in the album but I think that Synology's way is easier to manage : you have a datagrid of all "sharing links".

Image
Image
Image
Image

@axgd-code commented on GitHub (Sep 7, 2022): Another way to allow people to add some pictures is a public page just for the upload. I prefer the implementation of Nextcloud because you specify the sharing in the album but I think that Synology's way is easier to manage : you have a datagrid of all "sharing links". ![Image](https://user-images.githubusercontent.com/1721781/188964651-a0a21037-4119-4d11-87a1-ceb145b74c59.png) ![Image](https://user-images.githubusercontent.com/1721781/188964174-4141fd00-2118-4284-8475-21824c9b8027.png) ![Image](https://user-images.githubusercontent.com/1721781/188964173-facae990-8052-4d98-8579-b6d95cc9c61d.png) ![Image](https://user-images.githubusercontent.com/1721781/188964172-5fbb1b1f-6f24-4d44-8bff-d1daa05c4546.png)
OVERLORD commented 2026-02-04 17:44:23 +03:00
Author
Owner
Copy Link

@puregreen59 commented on GitHub (Sep 13, 2022):

agreed! would Love this

@puregreen59 commented on GitHub (Sep 13, 2022): agreed! would Love this
OVERLORD commented 2026-02-04 17:44:28 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Nov 4, 2022):

I'll just add that the google photos sharing solution works well for me, and doesn't seem overly complicated.

  1. Share urls are long random strings, and don't require passwords. I'm not sure exactly what pros/cons there are to this vs passwords, but it is easier to share IMO.

  2. Users can view without an account, but adding assets requires logging in.

I'm on board for multiple, expirable links too though.

@jrasm91 commented on GitHub (Nov 4, 2022): I'll just add that the google photos sharing solution works well for me, and doesn't seem overly complicated. 1. Share urls are long random strings, and don't require passwords. I'm not sure exactly what pros/cons there are to this vs passwords, but it is easier to share IMO. 2. Users can view without an account, but adding assets requires logging in. I'm on board for multiple, expirable links too though.
OVERLORD commented 2026-02-04 17:44:32 +03:00
Author
Owner
Copy Link

@bmachek commented on GitHub (Dec 25, 2022):

+1

@bmachek commented on GitHub (Dec 25, 2022): +1
OVERLORD commented 2026-02-04 17:44:50 +03:00
Author
Owner
Copy Link

@Cat-Ion commented on GitHub (Dec 28, 2022):

If possible, I would also love to have public shares of singular images, without having to create an album first. Should I create a separate issue for that?

@Cat-Ion commented on GitHub (Dec 28, 2022): If possible, I would also love to have public shares of singular images, without having to create an album first. Should I create a separate issue for that?
OVERLORD commented 2026-02-04 17:44:53 +03:00
Author
Owner
Copy Link

@Mortein commented on GitHub (Jan 7, 2023):

Can there be a separate password/secret from the album/asset being shared? The secret doesn't need to be customisable, just something random that isn't easily brute forceable which isn't related to the album.

Using just an identifier as a public share link is security through obscurity, and it scares me. Google does it wrong for both YouTube (unlisted videos) and Google Photos (share with link). The UUID RFC recommends against it, too.

Something like: /share/[asset-id]/[secret]

Only when both the asset identifier (photo/video/album/whatever) and secret are correct should the user gain access, in all other cases they should be told something generic (otherwise they know the ID is in use).

@Mortein commented on GitHub (Jan 7, 2023): Can there be a separate password/secret from the album/asset being shared? The secret doesn't need to be customisable, just something random that isn't easily brute forceable which isn't related to the album. Using just an identifier as a public share link is security through obscurity, and it scares me. Google does it wrong for both YouTube (unlisted videos) and Google Photos (share with link). The UUID RFC [recommends against it](https://www.rfc-editor.org/rfc/rfc4122#section-6), too. Something like: `/share/[asset-id]/[secret]` Only when both the asset identifier (photo/video/album/whatever) and secret are correct should the user gain access, in all other cases they should be told something generic (otherwise they know the ID is in use).
OVERLORD commented 2026-02-04 17:44:59 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 7, 2023):

Alex has started working on this and we aren't using a uuid in the url but randomly generated bytes using node's crypto library.

The url looks like this: /share/[secret]. If the secret is secure (not guessable through brute force) then we should be good from a security perspective.

The secret only grants access to a specific list of assets or album.

@jrasm91 commented on GitHub (Jan 7, 2023): Alex has started working on this and we aren't using a uuid in the url but randomly generated bytes using node's crypto library. The url looks like this: /share/[secret]. If the secret is secure (not guessable through brute force) then we should be good from a security perspective. The secret only grants access to a specific list of assets or album.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#112
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?