1

I want to provide a way for my users to download their data, which are stored in S3, through my app. Should I provide them with a public url followed by a key random key, as in this example?

http://s3.amazonaws.com/user-xyz123/folder/some_csv_file.csv

It could be possible for an attacker to brute-force the url, so can I use the TokenGenerator from the Django app to generate the 'xyz123' suffix?

Another alternative is to let users download files directly from my app, but this will place some strain on my app.

6
  • urls do pose a risk in my opinion, how long do the tokens last? do they expire once used? – Coderxyz Oct 14 '20 at 9:50
  • @Coderxyz Good question, I thought exposing the url (more specifically, the xyz123 portion) permanently to the user but now I guess that is not a good idea. My app relies on the bucket structure as in the example above to do its logic, so I can't be moving files around. – mick Oct 14 '20 at 9:56
  • tokens that don't expire after being used or after a short time are a no no. imagine if urls got accidentally cached somewhere. Google caches urls all the time too so it could open it upto meta data exploits. – Coderxyz Oct 14 '20 at 10:00
  • 1
    Thanks. The app is not a public app, users still need to sign in. – mick Oct 14 '20 at 10:06
  • 1
    Have you looked into presigned URLs? You do need a server that can generate them (or maybe there's a smarter way to generate URLs), but they effectively limit access to S3 objects, and I think they are only valid for a limited time. – millinon Oct 14 '20 at 14:27
0

As @millinon mentioned, use pre-signed urls. When a user requests to download a file, your Django app only needs to make one API call to AWS (generate_presigned_url), and then send the returned url back to the user.

From there the user will download the file directly from s3 via the url. This means, whether the file is 1MB or 10GB, or even 100GB, the strain on your app is constant, allowing S3 to handle the load usually introduced by larger files.

You can also set an expires in parameter for the URL, to ensure that the file isn't exposed for too long via the url. For files where you expect users to download immediately, this can be set to a short duration of ~1-2 minutes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.