Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm writing a mobile app that communicates with my server using REST. Upon every launch, the app makes a call to the server api to check whether there was a change in the user details (using a lastUpdate parameter), the api returns the updated user object in case there was a change.

Problem

The drawback to this approach of course, is that every launch of the app causes an api call (and an SQL query) to my server.

Solution

I had an idea to use HTTP ETAG\last-modified header and store the user details as a json file in S3 bucket (+ S3 access control). That way, the app can check against that file (instead of a direct call to the api). I will save lots of connections to my server and lots of db queries as well.

Question

It seems like a legit solution, though somehow I get the feeling that storing all my users data in files on S3, is not secure..

What do you think?

share|improve this question
    
My first thought is: premature optimization –  CodesInChaos Oct 23 '13 at 9:51

1 Answer 1

S3's access control is not really suitable for functionality. If every instance of the app uses the same credentials to access S3 then the JSON records could be compromised by an attacker who has decompiled the app.

if you want to make a change to a user record stored in S3, the change will not propagate immediately. So if you if your application has a user_state=disabled, then this change may not be reflected immediately in s3.

Consider using memcachd to cache the json records. Access the records using a temporary, random token.

share|improve this answer
    
Each user file will have it's unique random link. That link will be provided by the api to the app on its first launch. –  rizon Oct 22 '13 at 20:56
    
@rizon updated. –  Rook Oct 23 '13 at 3:07
    
"S3's access control is not really suitable for functionality. If every instance of the app uses the same credentials to access S3 then the JSON records could be compromised by an attacker who has decompiled the app." The files on S3 are READONLY. When there's a change to the user details the api server makes the changes to the file stored in S3. So no credentials are ever being public. –  rizon Nov 6 '13 at 21:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.