将任何用户文件上传到 S3 存储桶是否安全？

Question

I want to let users upload file to attach them to a form, is it safe for me to let them upload and retrieve any file or should I be wary of XSS or any other possible vulnerability? The files would be available from the amazonaws domain rather than my own.

Answer 1

The secure way to do this would be to use Pre-signed URLs to let them upload new files and only download specific files.

Pre-signed URLs are time-limited URLs that allow a specific file to be uploaded/downloaded. Your application will be responsible for generating these URLs for each specific user. (It is just a few lines of code.)

See:

• Uploading Objects Using Presigned URLs - Amazon Simple Storage Service
• Share an Object with Others - Amazon Simple Storage Service