用于投放图片的临时S3存储桶URL

Question

Using "aws/aws-sdk-php": "^3.0@dev"

I am creating a image sharing website but do not want people to copy my URLs to another site to steal my content/bandwidth.

I was originally storing the objects as

return $s3->putObject([
        'Bucket' => $bucket,
        'Key'    => $key,
        'Body'   => $file,
        'ACL'    => 'public-read',
    ]);

But I have removed 'public-read' so now the URL below no longer works

 https://mybucket-images.s3.us-west-1.amazonaws.com/' . $key);

What do I need to do to create a temporary URL that can still be client side cached to access the object?

One thing I was thinking was to change the key once a week or month, but it would require me to update all objects with a cronjob. There must be a way to create a temporary access URL?

Answer 1

Use your server to generate presigned url for the keys in the bucket.

//Creating a presigned request
$s3Client = new Aws\S3\S3Client([
    'profile' => 'default',
    'region'  => 'us-east-2',
    'version' => '2006-03-01',
]);

$cmd = $s3Client->getCommand('GetObject', [
    'Bucket' => 'my-bucket',
    'Key'    => 'testKey'
]);

$request = $s3Client->createPresignedRequest($cmd, '+20 minutes');
$presignedUrl = (string) $request->getUri();

taken from https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/s3-presigned-url.html

But you'd have to do this every time there's a request to your page. And the link will be valid everywhere. You just minimize the period of its validity.

If your website is an API based and you retrieve the url via API , this may be relevant to you:

• If your website has a login function, you can check for the auth logic prior giving the presigned url.

• If not, you can use Http Referrer (which can be spoofed). Or an api key (like in API Gateway)

Answer 2

If your intent is to make your content readable ONLY via a URL posted on your website - versus having the same web client using the same url accessed from another site NOT work, I think you are likely to find that rather difficult. Most of the ways that come to mind are fairly spoofable.

I would take a look at this and see if its good enough for you:

Restricting Access to a Specific HTTP Referrer

Answer 3

You can use the following code:

 // initiate connection to your S3 bucket
    $client = new S3Client(['credentials' => ['key' => 's3 key', 'secret' =>'s3 secrete'], 'region' => 's3 region', 'version' => 'latest']);

        $object = $client->getCommand('GetObject', [
            'Bucket' => 's3 bucket',
            'Key' => 'images/image.png' // file
        ]);

        $presignedRequest = $client->createPresignedRequest($object, '+20 minutes');
        $presignedUrl = (string)$presignedRequest->getUri();
        if ($presignedUrl) {
            return $presignedUrl;//presigned URL
        } else {
            throw new FileNotFoundException();
        }