Encrypted previews with server-side encryption (SSE)

Hello everyone,

Nextcloud by design doesn't encrypt file previews. Every time I enable server side encryption, I forget that previews are enabled by default and, won't be encrypted. Preview files can be high-resolution thumbnails of original images and documents which could potentially expose sensitive user data. The question is why doesn't Nextcloud encrypt previews? I think encrypting previews will introduce a performance penalty due to decryption processes every time a folder is loaded, but this can be mitigated with various solutions such as browser caching, PHP server caching, or allowing administrators to set a maximum resolution for previews to fine-tune performance. All of these solutions in my opinion are better than totally disabling previews which users have been familiar with for decades and not having them when SSE is enabled is a serious user experiance issue.
If such enhancement is not possible. At least when the server-side encryption (SSE) feature is enabled, users should be warned about potential data leakage from these previews.

Best

Start by reviewing Nextcloud's server-side encryption and preview subsystems, focusing on how previews are generated and stored when SSE is enabled. Determine whether encrypted previews or an administrator/user warning is feasible, and define the performance and security checks needed to consider the work complete.