diff --git a/compose/rest/attachment.go b/compose/rest/attachment.go
index 175c6f63e..42a8fa5fd 100644
--- a/compose/rest/attachment.go
+++ b/compose/rest/attachment.go
@@ -42,6 +42,10 @@ func (Attachment) New() *Attachment {
 
 // Attachments returns list of all files attached to records
 func (ctrl Attachment) List(ctx context.Context, r *request.AttachmentList) (interface{}, error) {
+	if !auth.GetIdentityFromContext(ctx).Valid() {
+		return nil, errors.New("Unauthorized")
+	}
+
 	f := types.AttachmentFilter{
 		NamespaceID: r.NamespaceID,
 		Kind:        r.Kind,
@@ -59,11 +63,19 @@ func (ctrl Attachment) List(ctx context.Context, r *request.AttachmentList) (int
 }
 
 func (ctrl Attachment) Read(ctx context.Context, r *request.AttachmentRead) (interface{}, error) {
+	if !auth.GetIdentityFromContext(ctx).Valid() {
+		return nil, errors.New("Unauthorized")
+	}
+
 	a, err := ctrl.attachment.With(ctx).FindByID(r.NamespaceID, r.AttachmentID)
 	return makeAttachmentPayload(ctx, a, err)
 }
 
 func (ctrl Attachment) Delete(ctx context.Context, r *request.AttachmentDelete) (interface{}, error) {
+	if !auth.GetIdentityFromContext(ctx).Valid() {
+		return nil, errors.New("Unauthorized")
+	}
+
 	_, err := ctrl.attachment.With(ctx).FindByID(r.NamespaceID, r.AttachmentID)
 	if err != nil {
 		return nil, err
@@ -89,6 +101,10 @@ func (ctrl Attachment) Preview(ctx context.Context, r *request.AttachmentPreview
 }
 
 func (ctrl Attachment) isAccessible(namespaceID, attachmentID, userID uint64, signature string) error {
+	if signature == "" {
+		return errors.New("Unauthorized")
+	}
+
 	if userID == 0 {
 		return errors.New("missing or invalid user ID")
 	}
diff --git a/messaging/rest/attachment.go b/messaging/rest/attachment.go
index 5b0c4d426..791a97491 100644
--- a/messaging/rest/attachment.go
+++ b/messaging/rest/attachment.go
@@ -45,6 +45,10 @@ func (ctrl *Attachment) Preview(ctx context.Context, r *request.AttachmentPrevie
 }
 
 func (ctrl Attachment) isAccessible(attachmentID, userID uint64, signature string) error {
+	if signature == "" {
+		return errors.New("Unauthorized")
+	}
+
 	if userID == 0 {
 		return errors.New("missing or invalid user ID")
 	}