diff --git a/routers/common/blockexpensive.go b/routers/common/blockexpensive.go
index 62cb1c70506..1285f2be351 100644
--- a/routers/common/blockexpensive.go
+++ b/routers/common/blockexpensive.go
@@ -39,20 +39,22 @@ func isRoutePathExpensive(routePattern string) bool {
 		return false
 	}
 
+	// an endpoint is expensive if crawlers could consume a lot of resources by accessing it
 	expensivePaths := []string{
 		// code related
+		// media and raw endpoints are for single file accesses and useful for rendering README images, not that expensive
+		// the single file endpoints won't be accessed by crawlers as long as the commits/files endpoints are protected from crawlers
 		"/{username}/{reponame}/archive/",
 		"/{username}/{reponame}/blame/",
 		"/{username}/{reponame}/commit/",
 		"/{username}/{reponame}/commits/",
 		"/{username}/{reponame}/compare/",
 		"/{username}/{reponame}/graph",
-		"/{username}/{reponame}/media/",
-		"/{username}/{reponame}/raw/",
 		"/{username}/{reponame}/rss/branch/",
 		"/{username}/{reponame}/src/",
 
 		// issue & PR related (no trailing slash)
+		// because it would cause heavy database queries, and PR pages need to load a lot of git data
 		"/{username}/{reponame}/issues",
 		"/{username}/{reponame}/{type:issues}",
 		"/{username}/{reponame}/pulls",
diff --git a/tests/integration/signin_test.go b/tests/integration/signin_test.go
index dd7f3f4c2b9..2b24ea0a78a 100644
--- a/tests/integration/signin_test.go
+++ b/tests/integration/signin_test.go
@@ -188,6 +188,11 @@ func TestRequireSignInView(t *testing.T) {
 		req = NewRequest(t, "GET", "/user2/repo1/src/branch/master")
 		resp := MakeRequest(t, req, http.StatusSeeOther)
 		assert.Equal(t, "/user/login?redirect_to=%2Fuser2%2Frepo1%2Fsrc%2Fbranch%2Fmaster", resp.Header().Get("Location"))
+
+		req = NewRequest(t, "GET", "/user2/repo1/media/branch/master/README.md")
+		MakeRequest(t, req, http.StatusOK)
+		req = NewRequest(t, "GET", "/user2/repo1/raw/commit/65f1bf27bc3bf70f64657658635e66094edbcb4d/README.md")
+		MakeRequest(t, req, http.StatusOK)
 	})
 }