> Not to sound cold or uncaring, but IMO that’s a user configuration concern, it shouldn’t be Oak’s concern. What if a user fails to put the proper ACLs on a resource in Oak and thus allows users to access it who shouldn’t? Isn’t that basically the same concern?
Except there's a subtle difference here. If I understand correctly (and feel free to point it out if that is not the case) security of the generated url relies on 2 things: a url that is hard to guess and a ttl that needs to be short enough to get the job done but not big enough to cause harm if the url is made public. So the concern I raised is about the ttl, this seems sensitive enough to warrant a discussion and probably a few log statements for traceability.
