Optimized way of restricting access to images in backend

Question

I am working on an app that has some social network elements: users can create posts with images and they can share these publicly or with friends.

I am now considering the security aspect of this. These images should only be available to the person that uploaded them and the people they select to view them.

From the posts I have seen it seems that one of the recommended ways is to expose an API endpoint through my backend service to control access through it (this way I can check a user's permissions) and then return the requested image but I feel that serving images this way would be quite expensive.

Are there any other approaches that do not sacrifice security but achieve a good performance?

In case it matters, I am using Spring Boot for my backend, Expo + React Native for my app and I am planning to store the images on AWS S3

Answer 1

It turns out S3 on AWS allows access to files through signed URLs, which means only people with the given signed URL can access the file. This signed URL can be further restricted by specifying the duration for which the signed URL will be valid.

Generating these URLs can be done by the back-end service without reaching out to AWS, so that does not create a big performance hit.