I am new to the concept of security. I have a simple image server that takes in username and an image to be uploaded. Given a username on a different URL, all images can be viewed as a slide-show on the browser. The image is stored in the S3, and the URL to the image in S3 is stored in database in RDS. I was shortlisting all security measures that need to be taken. I would like to know more points if i missed.

  1. HTTPs connection for file encryption.
  2. Encryption of image while uploading/downloading (is it mandatory or overkill) ?
  3. What database security / Access controls measures are required if any ?
  • 1
    Given a URL with username, the image can be directly viewable without logging in? – wei Dec 13 '15 at 21:40
  • 2
    Encryption of image while uploading/downloading (is it mandatory or overkill) ? Overkill, if HTTPS is used already. ... As wei said already, you need to make sure that images can only viewed by permitted users. – deviantfan Dec 13 '15 at 22:38
  • 1
    This question covers some of the security elements related to receiving untrusted images. – Steve Dodier-Lazaro Dec 13 '15 at 23:43
  • 1
    Does a user have to be logged in to upload a file? What if i guess another users username and just start uploading to that? – d0nut Dec 14 '15 at 16:40

2)overkill unless people are uploading something like ssn's or CC's, in which case it could be useful if a proxy, vpn, malicious access point, or other service stops https

3)sql injection if SQL, other problems if not.

after uploading the file you need to make sure it gets displayed as an image

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.