直接将浏览器上传到S3中的安全性问题

Question

The main security concern in direct js browser uploads to S3 is that users will store their S3 credentials on the client side.

To mitigate this risk, the S3 documentation recommends using a short lived keys generated by an intermediate server:

1. A file is selected for upload by the user in their web browser.
2. The user's browser makes a request to your server, which produces a temporary signature with which to sign the upload request.
3. The temporary signed request is returned to the browser in JSON format.
4. The browser then uploads the file directly to Amazon S3 using the signed request supplied by your server.

The problem with this flow is that I don't see how it helps in the case of public uploads.

Suppose my upload page is publicly available. That means the server API endpoint that generates the short lived key needs to be public as well. A malicious user could then just find the address of the api endpoint and hit it everytime they want to upload something. The server has no way of knowing if the request came from a real user on the upload page or from any other place.

Yeah, I could check the domain on the request coming in to the api, and validate it, but domain can be easily spoofed (when the request is not coming from a browser client).

Is this whole thing even a concern ? The main risk is someone abusing my S3 account and uploading stuff to it. Are there other concerns that I need to know about ? Can this be mitigated somehow?

Answer 1

Suppose my upload page is publicly available. That means the server API endpoint that generates the short lived key needs to be public as well. A malicious user could then just find the address of the api endpoint and hit it everytime they want to upload something. The server has no way of knowing if the request came from a real user on the upload page or from any other place.

If that concerns you, you would require your users to login to your website somehow, and serve the API endpoint behind the same server-side authentication service that handles your login process. Then only authenticated users would be able to upload files.

---

You might also want to look into S3 pre-signed URLs .