Announcing Changes to Receipt URL Permissions
Comments
-
I'd love to hear an explanation from Expensify about why the decision was made to change all image & PDF receipts to private, but not give the customer a setting to manage the behavior. And also why eReceipts are still all public.
In the absence of a logical explanation it looks like at least one of the follow conjectures is true:- Expensify doesn't really take privacy seriously (some receipts are private and some are public).
- Expensify doesn't trust customers to make their own decisions regarding their privacy comfort level.
- Expensify made a system change which had the unintended side effect of making PDF & image receipts private. Once they realized, they decided to keep it because they either didn't think customers would mind or it's too costly to fix.
Having done some programming myself, I wouldn't be surprised if #3 is the case. That they didn't mean to change this behavior, but decided to embrace it and pretend like they did. AKA:
-
Greg Schroeder Expensify Success Coach - Admin, Expensify Team, Expensify Student Ambassador Posts: 64 Expensify TeamOptionsHello everyone, thanks for your patience and also your very valuable feedback! Over the last week, we've been in constant communication with our engineering team to discuss the effects this change has had on our user base. I wanted to share the outcome of those discussions here.
As of today, we've begun the process of reverting the change that required direct access to receipt images in Expensify in order to view them. The rollback process may take a few business days to complete, but it's in the works as we speak. With that said, we'll be sure to update the thread once we restore broad access to receipt URLs.
To be clear, we're still committed to securing receipts. We've been discussing alternative solutions, and we'll be including ideas brought up in this thread in the conversation. With that said, a primary focus of the next solution will be ensuring it works in tandem with common use cases like those brought up here.
Thanks again for your participation here! We'll let you know once we have an update. -
Great news! Thank you!!!
-
Thanks the update and great news @Greg Schroeder. Appreciate the Expensify team hearing and acting on our feedback.
-
Greg Schroeder Expensify Success Coach - Admin, Expensify Team, Expensify Student Ambassador Posts: 64 Expensify TeamOptionsAll right, thanks for your patience! This change was officially reverted, so external clients/entities should be in the clear to view receipt images via URL, regardless of their read access in Expensify.
If you see any issues with this, please let us know and we can look into those right away. 👍 -
@Greg Schroeder Tested with a few receipts and it's working like magic (again) now. Thanks!
-
Christina Dobryzynski Expensify Success Coach - Admin, Expensify Team, Expensify Student Ambassador Posts: 267 Expensify TeamOptionsFantastic! Thank you so much for letting us know, @cslim! Please feel free to share any suggestions about how we can create a URL security feature that will align with how your current workflow. Thank you! -
Fantastic update.
I really wasn't looking forward to migrating platforms. -
Matt Moore Expensify Customer, Expensify Success Coach - Admin, Expensify Team, Expensify Student Ambassador Posts: 132 Expensify TeamOptions@guyellis1988
That's really good to hear! Let us know your thoughts on receipt URL security, if you've got them. -
@Matt Moore
I think the best solution proposed is a "receipt auditor" role. This would:
1) Ensure receipts cannot be blindly read by anyone who guesses the URL
2) Would allow for the receipts to be read by someone with the "receipt auditor" role assigned; they would still need to know the URL.
3) This permission would *not* give access to any other areas of Expensify
I also feel that receipt retrieval should be added to the API; this would open up other avenues of automation. -
Hi @guyellis1988 – thanks for the suggestions! I would recommend adding this as a topic in the Ideas suggestion of our Community! The most popular ideas found here are reviewed by the Expensify team and have a real chance of being placed on the roadmap. Be sure to vote for your own idea, too!
-
@Cortney Ofstad @Karisa_Latta @Victoria O'Leary @Sheena Trepanier @Nicole Trepanier
Any updates? Or do all of your customers need to go through another month of inefficient use of receipts from Expensify? -
@Jason_Richards_25 - Take a look at all the messages written on Nov 21.
-
@maasj thanks! I didn't notice that there was a second page of comments!
-
@Sheena Trepanier Is there a way to configure Expensify to automatically export into NetSuite a pdf copy of the receipts attached to the expense report? So that both the expense report and the PDF copy are attached in Netsuite together?
-
@MaryBBT currently the integration only supports exporting the Report URL, where you'll be able to download the PDF from there.
-
@Nicole Mendonca thanks! I will submit as an idea :).
-
@MaryBBT Fab! Feel free to post it here so others in this post can vote!
-
-
@Sheena Trepanier there's a problem I'm hoping you can help with. Indeed if the setting is turned on the receipt is not viewable through the expensify URL, however, it seems expensify's AWS S3 buckets are publicly accessible.
For example if you try to access a receipt via expensify using https://www.expensify.com/receipts/GUID one correctly gets a 404. However, if you replace the expensify URL with the S3 URL (which one can deduce from your page), for example https://s3.amazonaws.com/receipts.expensify.com/GUID then your receipt is accessible without any kind of authentication (you can try replacing the GUID bit with an actual receipt ID from your account and open it in private browsing/incognito)
At a minimum, it seems there should be domain/session authentication for this to be accessible. Ideally this buckets should not be public, this can easily be changed in AWS. Can you please forward this bug to the appropriate engineering group? thanks.
