title: Amazon access key showing in URL for Carrierwave and Fog
body: <p>I just switched from storing my images uploaded via Carrierwave locally to using Amazon s3 via the fog gem in my Rails 3.1 app. While images are being added, when I click on an image in my application, the URL is providing my access key and a signature. Here is a sample URL (XXX replaced the string with the info):</p>
  
  <pre><code>https://s3.amazonaws.com/bucketname/uploads/photo/image/2/IMG_4842.jpg?AWSAccessKeyId=XXX&amp;Signature=XXX%3D&amp;Expires=1332093418
  </code></pre>
  
  <p>This is happening in development (localhost:3000) and when I am using heroku for production. Here is my uploader:</p>
  
  <pre><code>class ImageUploader &lt; CarrierWave::Uploader::Base
   include CarrierWave::RMagick
   storage :fog
    def store_dir
      "uploads/#{model.class.to_s.underscore}/#{mounted_as}/#{model.id}"
    end
    process :convert =&gt; :jpg
    process :resize_to_limit =&gt; [640, 640] 
    version :thumb do
      process :convert =&gt; :jpg
      process :resize_to_fill =&gt; [280, 205]
    end
    version :avatar do
      process :convert =&gt; :jpg
      process :resize_to_fill =&gt; [120, 120]
    end
  end
  </code></pre>
  
  <p>And my config/initializers/fog.rb :</p>
  
  <pre><code> CarrierWave.configure do |config| 
    config.fog_credentials = { 
       :provider               =&gt; 'AWS', 
       :aws_access_key_id      =&gt; 'XXX', 
       :aws_secret_access_key  =&gt; 'XXX',
     } 
    config.fog_directory  = 'bucketname' 
    config.fog_public     = false
  end  
  </code></pre>
  
  <p>Anyone know how to make sure this information isn't available?</p>
  
  <p>UPDATE: Adding view and controller code:
  from a partial in users/show.html.erb:</p>
  
  <pre><code>&lt;% if @user.photos.any? %&gt;
    &lt;% for photo in @user.photos %&gt;
      &lt;li class="span4 hidey"&gt;
      &lt;div class="thumb_box"&gt;
        &lt;%=link_to(image_tag(photo.image_url(:thumb).to_s), photo.image_url.to_s,   
                                                         :class=&gt;"lb_test") %&gt;
        ...
      &lt;/div&gt;    
      &lt;/li&gt;
    &lt;% end %&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>users_controller.rb:</p>
  
  <pre><code> def show
     @user = User.find(params[:id])
   end
  </code></pre>
  
  <p>UPDATE: Adding an error page I get when removing the access key information from the url:</p>
  
  <pre><code>This XML file does not appear to have any style information associated with it. The document tree is shown below.
  
  &lt;Error&gt;
   &lt;Code&gt;AccessDenied&lt;/Code&gt;
    &lt;Message&gt;Access Denied&lt;/Message&gt;
     &lt;RequestId&gt;47077D6EC13AD1D8&lt;/RequestId&gt;
       &lt;HostId&gt;+HTeODcWTqv3gbRIAwf+lI6sPzfNTegDXjT9SnMdqrYr7gLD1TD0qN+OgMLwA1JO
       &lt;/HostId&gt;
   &lt;/Error&gt;
  </code></pre>