I removed someone from a shared file, but they can still see it
You removed a person from a shared document, folder or photo album, and they say it still opens. Usually the system is doing exactly what it was told — just not what you meant.
Work through the routes in order
| Route | How to spot it | What closes it |
|---|---|---|
| Anyone with the link | The sharing panel shows link access for anyone, not just named people | Switch link access to restricted, or create a new link (the old one stops working) |
| A group, team, channel or whole organisation | The sharing list shows a group or domain, or the file sits in a shared folder or drive | Remove the group, move the file out of the shared folder, or remove the person from the group |
| Inherited access from a parent folder | You removed them from the file, but they still have the folder | Change the folder's sharing, or move the file |
| An open tab or a cached page | It still shows, but a reload or a new device fails | Nothing to do: the next request is checked. Apps that cache aggressively may show the old copy until they sync |
| A session or token that is still valid | Access stops after a while on its own | Some services re-check every request; others only when a token expires (often an hour). Signing the person out of all sessions, if you control their account, closes this sooner |
| A copy they already have | Downloaded, synced to a laptop, attached to an email, screenshotted | Nothing on the website can recall it |
Why a website cannot snatch back a copy
Sharing works by sending bytes to someone's device. Once they arrive, the website has no control over them. Revoking access only means the next request will be refused (a 403 or 404 instead of the file). A “view only” or “disable download” setting makes casual copying harder, but anything that shows on a screen can be photographed or recorded.
So if the file contained something sensitive, also deal with the content: change any passwords or keys it mentioned, and assume the person kept a copy.
Why “anyone with the link” surprises people
A link with link-based access is the key itself. The service does not know who is holding it, so it cannot tell your removed colleague from anyone else. Forwarded emails, chat history and browser history all keep that key. Turning link access off, or replacing the link, is the only way to change the lock.
For the person building the app
If users report this in your own product, check that every request for the file runs a permission check (not just the page that lists it), that responses with private content send Cache-Control: private, no-store (see no-cache vs no-store), and that sessions or tokens are short-lived or revocable (see revoking a JWT). The full pattern is in designing share links you can revoke.
To play with it, Wirebook's old link lesson lets you be the guard at the door: take a pretend visitor's badge away, make a new link, and see why a saved copy stays saved.
Related
Can you revoke an S3 presigned URL? · Designing share links you can revoke · How to revoke a JWT before it expires · HTTP 401 vs 403 · no-cache vs no-store · JWT decoder · Wirebook: does the old link still work? · Fusenote: one-time notes
Questions
Why can someone still open a file after I removed them?
Usually because link sharing is set to anyone with the link, they are in a group or folder that still has access, their tab or app is showing a cached copy, their session has not been re-checked yet, or they already saved a copy.
Does making a new link stop the old one?
In most services, yes: resetting or replacing a link makes the old address stop working. Anyone you still want to share with needs the new one.
Can I delete a copy someone downloaded?
No. Revoking access only stops future requests. Assume they kept it and change any secrets it contained.
Does view-only stop copying?
It makes downloading harder, but anything shown on a screen can be photographed or recorded. Do not rely on it for secrets.
How long can access last after I remove someone?
It depends on the service. Some check every request; others accept an existing session or token until it expires, often within an hour. Saved copies last forever.
Published .