Project overview

FileShare is a full-stack application for secure storage and sharing of files. The project was created to explore backend architecture, authentication, encryption, database design and frontend development in a single application.

Images

User page:

Login page:

Run locally

Note that FileShare is an educational project under active development. It has not undergone an independent security audit and should NOT be used to store sensitive or irreplacable data.

Backend:

cd backend
bun install
bun prisma migrate dev
bun run src/server.ts

Backend environment variables (to be stored in backend/.env):

DATABASE_URL=<url_to_database>
FILE_MASTER_KEY=<master_key>

To generate the required master key, it's possible to run

openssl rand -base64 32

NOTE: if this key is lost, all encrypted files are lost.

Frontend:

cd frontend
bun install
bun run dev

Frontend environment variables (to be stored in frontend/.env):

VITE_API_BASE='/api' # "prefix" for express api paths

Current features

• User registration and login
• Ed25519-signed JWT authentication
• Encrypted file storage using AES-256-GCM
• Folder system and breadcrumb navigation
• File upload and download
• File metadata persisted through Prisma and SQLite
• React frontend
• Express api running on Bun

Planned features

• File sharing
• Permission management
• Background workers
• End-to-end encryption

Current limitations

• Files are stored on local filesystem
• SQLite used for local development
• File sharing not yet implemented
• Files are buffered in memory during encryption and decryption
• Currently, the server has access to decrypted file contents and encryption keys

Architecture

Frontend
↓
Express REST API
↓
Authentication middleware
↓
Controllers
↓
Database / Storage

The react frontend is currently only a visual interface for the actual file system. Everything related to cryptography happens in the backend. In the future, I plan to move file key generation and encryption/decryption to the frontend for zero-knowledge encryption.

The authentication middleware uses JWT to create and verify user sessions, using Ed25519. For the implementation, see here.

File metadata is stored in SQLite through Prisma, while encrypted file contents are stored separately on the local file system. The latter is implemented by storing encrypted files here, while the former is realized by using an SQLite database.

Encryption design

Upon uploading a file, the backend runs the following encryption process

1. Receive raw file data
2. Generate random 256-bit AES file encryption key, and random 96-bit file initialization vector (IV)
3. Encrypt file with AES-256-GCM using the file encryption key and IV
4. Encrypt the file encryption key using AES-256-GCM with server KEK and new random IV
5. Store encrypted file data in storage and file metadata in db

Tech stack

Frontend

• React
• TypeScript
• Vite

Backend

• Bun
• Express
• Prisma
• SQLite

Security

• JWT
• AES-256-GCM

Storage

• Local filesystem

What I learned

The project was primarily an opportunity to gain experience with design and implementation of a secure backend, as well as structuring a full-stack application. Additionally, this project has provided the possibility to reason upon, explore and implement encryption, digital signatures and authentication in terms of both security and efficiency.