0

I am new to the concept of security. I have a simple image server that takes in username and an image to be uploaded. Given a username on a different URL, all images can be viewed as a slide-show on the browser. The image is stored in the S3, and the URL to the image in S3 is stored in database in RDS. I was shortlisting all security measures that need to be taken. I would like to know more points if i missed.

  1. HTTPs connection for file encryption.
  2. Encryption of image while uploading/downloading (is it mandatory or overkill) ?
  3. What database security / Access controls measures are required if any ?
Improve this question
4
  • 1
    Given a URL with username, the image can be directly viewable without logging in?
    – xyz
    Dec 13, 2015 at 21:40
  • 2
    Encryption of image while uploading/downloading (is it mandatory or overkill) ? Overkill, if HTTPS is used already. ... As wei said already, you need to make sure that images can only viewed by permitted users.
    – deviantfan
    Dec 13, 2015 at 22:38
  • 1
    This question covers some of the security elements related to receiving untrusted images.
    – Steve Dodier-Lazaro
    Dec 13, 2015 at 23:43
  • 1
    Does a user have to be logged in to upload a file? What if i guess another users username and just start uploading to that?
    – d0nut
    Dec 14, 2015 at 16:40

1 Answer 1

Reset to default
1

2)overkill unless people are uploading something like ssn's or CC's, in which case it could be useful if a proxy, vpn, malicious access point, or other service stops https

3)sql injection if SQL, other problems if not.

after uploading the file you need to make sure it gets displayed as an image

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .