I want to provide a way for my users to download their data, which are stored in S3, through my app. Should I provide them with a public url followed by a key random key, as in this example?


It could be possible for an attacker to brute-force the url, so can I use the TokenGenerator from the Django app to generate the 'xyz123' suffix?

Another alternative is to let users download files directly from my app, but this will place some strain on my app.

  • urls do pose a risk in my opinion, how long do the tokens last? do they expire once used?
    – Coderxyz
    Oct 14, 2020 at 9:50
  • @Coderxyz Good question, I thought exposing the url (more specifically, the xyz123 portion) permanently to the user but now I guess that is not a good idea. My app relies on the bucket structure as in the example above to do its logic, so I can't be moving files around.
    – mick
    Oct 14, 2020 at 9:56
  • tokens that don't expire after being used or after a short time are a no no. imagine if urls got accidentally cached somewhere. Google caches urls all the time too so it could open it upto meta data exploits.
    – Coderxyz
    Oct 14, 2020 at 10:00
  • 1
    Thanks. The app is not a public app, users still need to sign in.
    – mick
    Oct 14, 2020 at 10:06
  • 1
    Have you looked into presigned URLs? You do need a server that can generate them (or maybe there's a smarter way to generate URLs), but they effectively limit access to S3 objects, and I think they are only valid for a limited time.
    – millinon
    Oct 14, 2020 at 14:27

1 Answer 1


As @millinon mentioned, use pre-signed urls. When a user requests to download a file, your Django app only needs to make one API call to AWS (generate_presigned_url), and then send the returned url back to the user.

From there the user will download the file directly from s3 via the url. This means, whether the file is 1MB or 10GB, or even 100GB, the strain on your app is constant, allowing S3 to handle the load usually introduced by larger files.

You can also set an expires in parameter for the URL, to ensure that the file isn't exposed for too long via the url. For files where you expect users to download immediately, this can be set to a short duration of ~1-2 minutes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .