Geek Answers Handbook

Amazon S3 assigned url - Invalidate manually or one-time download

I use S3 to accept direct orders from a user on S3. Therefore, I will use pre-signed URLs.

After a successful upload, AWS Lambda will verify that the file upload is an image, and then the client will tell my server that it has finished uploading.

Then my server checks if this file exists in S3 (if Lambda detects an invalid image, it deletes it). If so, then the rest of the application logic will follow.

However, there is a loophole in this mechanism. The user can use the same URL to download the malicious file after he informs my server that he has finished the download (and originally transferred the valid file).

Lambda will delete the file anyway, but now my server will think that the file exists, but in fact it doesn’t exist.

Is there a way to generate a one-time downloadable pre-signed URL, or is it possible to forcefully cancel the URL that was generated but not expired yet?

+4
source share
2 answers

Including this in response ...

After the file is uploaded, move it to Lambda (using the copy objects API ), i.e. from uploads/123.pngto received/123.pngor something like that.

URL, uploads/123.png. Lambda . received/ uploads/ , .

+2

A URL /. URL URL.

URL. URL , URL. , , URL- .

+2

More articles:


All Articles