我应该直接从Android应用上传到Google云端存储吗？

Question

This is a security question.

I have an Android app that allows users to upload their private images to my Google Cloud Storage bucket. I have two options:

1. Send the image data to my server, which will then handle the upload.

2. Perform the upload directly via the client (Android app).

In my case, the files need to be publicly visible (to allow users to share their uploads), so I use obscure randomly-generated URLs to ensure nobody stumbles upon private images.

I can't figure out any way to make the second approach secure , because:

• I would need to embed my API access credentials within the app, which is impossible to do securely.

• If somebody got their hands on my credentials, they could list the contents of the bucket and discover everyone's files. This would be terrible!

• The absence of a working example for Android on the Google Cloud Platform documentation also suggests that Google don't support the client approach. (There's a general Java solution, but it will not work on Android out-of the box).

Despite all of these shortcomings, I know that a many people have chosen the client upload approach. I wonder if anyone who has done so could please explain how they have avoided the above security issues?

Answer 1

The very most secure option involving the customers directly uploading the data would be to have your server generated signed URLs and vend them to users when they want to upload something. The server would pick a unique object name, generate a URL that would be used to upload the object, then sign that URL with a service account that has permission to write to that bucket. Presumably you have some mechanism of authenticating users of your application, and you would only vend signed URLs to users who passed whatever current check you're using.

The downside of this approach is the added complexity of implementing a signed URL vending service as well as requiring the customer to make two requests instead of one. The upside is giving your server near-perfect control of what customers may do.

Note that for uploads you have two options for signed URLs: a regular signed URL , and a signed "policy document" that gives the caller a bit more leeway on what sort of uploads are acceptable.