CODEWITHSUNDEEP
amazon-s3amazon-web-services
Kyle
Kyle

Reputation: 33739

amazon s3 for downloads how to handle security

I'm building a web application and am looking into using Amazon S3 to store user uploads.

My concern is, I dont want user A to see his download link for a document he uploaded is urltoMyS3/doc1234.pdf and try urltoMyS3/doc1235.pdf and get another users document.

The only way I can think of to do this, is to only allow the web application to connect to S3, then check if the user has access to a file on the web application, have the web app download the file, and then serve it to the client. The problem with this method is the application would have to download the file first and would inevitably slow the download process down for the user.

How is user files typically handled with Amazon S3? Or is it simply not typically used in a scenario where the files should not be public? Is there another service for something like this?

Thanks

Upvotes: 12

Views: 9593

Answers (3)

stilldodge
stilldodge

Reputation: 204

You can do this by generating the appropriate links, see the following

https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#RESTAuthenticationQueryStringAuth

Upvotes: 4

Michal Klouda
Michal Klouda

Reputation: 14521

You can implement Query String Authentication, which will solve your problem.

Query string authentication is useful for giving HTTP or browser access to resources that would normally require authentication. The signature in the query string secures the request. Query string authentication requests require an expiration date. You can specify any future expiration time in epoch or UNIX time (number of seconds since January 1, 1970).

Upvotes: 10

Mike Brant
Mike Brant

Reputation: 71422

If time-bound authentication will not work for (as suggested in other answers). You could consider implementing something like s3fs to mount your S3 bucket as a drive on your web application server. In this manner you can simply make your authentication and then serve up the file directly to the user, without them having any idea that the file resides in S3. Similarly, you can simply write uploaded files directly to this s3fs mount.

S3fs, also allows you to configure a local cache of the S3 directory on your machine for faster access.

This works nicely in a cluster web server environment as well, as you can just have each server mount the s3fs drive and perform/read/writes on it independently.

A link with more info

Upvotes: 0

Related Questions