What’s the Most Secure Way to Add Dropbox Storage to a Locally Hosted Inventory App?
Asked by
MellowCedar47
I'm building a basic inventory management website for my family business with very limited funds. It currently runs locally on our computer, but we're running out of space for documents, photos, and other records. I'd also like cloud storage so we have backups if the computer fails. We already pay for Dropbox, so I'd prefer to use that rather than add another service.
The integration itself is easy to generate, but I'm concerned about security. I want the application to access only the files it needs, without being able to browse or retrieve anything else in the Dropbox account. Ideally, even if the application were compromised, an attacker could only reach the files that are part of this inventory system. What is the safest way to set this up?
Answers
In Dropbox, create an app with the “App folder” access type rather than “Full Dropbox.” Dropbox will give the app its own dedicated folder, which prevents it from accessing the rest of the account. Request only the permissions you need, such as file read and write access, instead of enabling every scope.
Keep the client secret, access token, and refresh token exclusively on the backend. Never put them in browser code or send them to users. For downloads, generate short-lived links when a file is requested instead of storing permanent public links. Also make sure the app checks that the requested file belongs to the current user or record; folder-level restrictions alone do not replace authorization in your own application.
Reply to this answer
The Dropbox app folder limits the integration to that folder, but anything inside it is still accessible to the application. Use a dedicated folder containing only inventory-related files, and validate every filename or file ID on the server rather than accepting arbitrary paths from the browser.
You should also back up the actual inventory database separately. Cloud-storing photos and documents does not automatically protect the database, and a bug or ransomware incident could otherwise overwrite both your local data and its synchronized copy.
Reply to this answer
An S3-compatible storage service could be a better fit for an application because it supports narrowly scoped credentials and private objects, but Dropbox can work if you already have it. The bigger concern is maintaining a custom application securely over time: authentication, updates, token rotation, input validation, backups, and recovery testing all matter. Avoid treating generated code as a substitute for reviewing those areas.
Reply to this answer
If the site is only running on a local computer, keep the Dropbox integration in a server-side component and do not expose that computer directly to the internet. Use HTTPS for any remote access, restrict who can log in, and maintain separate offline or versioned backups so an accidental deletion or compromised account cannot destroy every copy.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions