It’s my understanding that images stored in /media should only be accessible if authenticated. (source). If i take a camera snapshot with filename: /media/test.jpg, the image is publicly available through the url: https://mydomain.com/media/local/test.jpg
What am I doing wrong?
EDIT:
After some testing, it seems that the image is protected until i create a notification that includes the image. Before the notification is sent, image is safe. After the notification is sent, the image is publicly available. Is this to be expected from home assistant/firebase notifications?