title: Rails 5.2: authorize access to ActiveStorage::BlobsController#show
body: <p>I would like to authorize access to <code>ActiveStorage</code> attachments and looking at the source code of <code>BlobsController</code> (<a href="https://github.com/rails/rails/blob/master/activestorage/app/controllers/active_storage/blobs_controller.rb" rel="nofollow noreferrer">https://github.com/rails/rails/blob/master/activestorage/app/controllers/active_storage/blobs_controller.rb</a>) is stated the following:</p>
  
  <pre><code># Take a signed permanent reference for a blob and turn it into an expiring service URL for download.
  # Note: These URLs are publicly accessible. If you need to enforce access protection beyond the
  # security-through-obscurity factor of the signed blob references, you'll need to implement your own
  # authenticated redirection controller.
  class ActiveStorage::BlobsController &lt; ActiveStorage::BaseController
    include ActiveStorage::SetBlob
  
    def show
      expires_in ActiveStorage.service_urls_expire_in
      redirect_to @blob.service_url(disposition: params[:disposition])
    end
  end
  </code></pre>
  
  <p>But even the notes above suggest to create a custom controller I would need also to override the routes generated by ActiveStorage, since they are pointing to the original controllers, and redefining them on my <code>routes.rb</code> seems to throw an exception. Also I don't want to expose these routes anymore as they are not being authorized and someone could take the <code>signed_id</code> of the blob and get the attachment using the original endpoint.
  Looping over the routes on the app initialization and deleting the old ActiveStorage routes and inserting the new ones seems the best solution for now, but I would like to avoid that.</p>
  
  <p>Any suggestions? </p>