AWS S3/Ruby on Rails/heroku：我的应用程序中的安全漏洞
我的配置中有一条路线，其中表示对于页面（例如 /secure），需要登录（通过 authlogic 完成）。我的控制器中的 before_filter 负责处理这个问题。效果很好，页面及其资源通过应用程序的访问受到限制。
问题是，我们使用 Amazon S3 来存储部署到 heroku 的这个应用程序（基于 RefineryCMS）。我有一个水桶，效果很好。
但是，插入应用程序安全部分的任何资源都可以通过浏览器直接访问。换句话说，/secure 页面包含 pdf 文件等项目。虽然通过该应用程序，资源受到保护，但可以从 Internet 上的任何位置访问这些 pdf 文件（示例 URL）：http://s3.amazonaws.com/my_bucket/images/1234/the_file_which_should_be_secure.pdf
我可以在 S3 上进行细粒度的访问控制吗？我必须创建一个新存储桶吗？理想情况下，我想在我的资源上设置一个标志，使其在互联网中不可见 - 不知道。
欢迎任何建议。
PS openid.org 有一个过期的 ssl 证书，因此需要创建一个新的空帐户，因为我无法登录
I have a route in my config which says that for a page, say /secure, there is a login required (done via authlogic). A before_filter in my controller takes care of that. That works fine, the page and its resources have restricted access - through the application.
Trouble is, we are using Amazon S3 for storage on this app (based on refinerycms) deployed to heroku. I have a bucket and it works fine.
However, any resource inserted in the secure part of the application is directly accessible through the browser. In other words, the /secure page contains items like pdf files. While through the app the resources are secured, those pdf files are accessible from anywhere in the Internet (example URL): http://s3.amazonaws.com/my_bucket/images/1234/the_file_which_should_be_secure.pdf
Can I do fine-grained access control on S3? Do I have to create a new bucket? Ideally I'd like to set a flag on my resource which makes it invisible in the Internet - don't know.
Any suggestion welcomed.
P.S. openid.org has an expired ssl cert, so needed to create a new empty account as I could not login
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可以尝试此页面上的内容：
http://thewebfellas .com/blog/2009/8/29/protecting-your-paperclip-downloads
具体信息位于“不再流式传输，需要重定向”部分下。
摘要： S3 有四种预设访问策略，通过使用身份验证读取策略，S3 提供了一种为仅在指定时间段内有效的私有内容生成经过身份验证的 URL 的方法。
我实际上还没有这样做，所以请告诉我它是否适合您。 :-)
You could try what is said on this page:
http://thewebfellas.com/blog/2009/8/29/protecting-your-paperclip-downloads
The specficics are under the section "No more streaming, time for a redirection".
Summary: S3 has four canned access policies, by using the authenticated-read policy S3 provides a way to generate an authenticated URL for private content that only works for a specified period of time.
I haven't actually done this, so please let me know if it works for you. :-)
最简单、最容易的解决方案就是使用随机的、不可猜测的文件名来命名您的 S3 资产，然后仅向应该有权访问的人员公开秘密 URL。
这就是 Facebook 照片和许多其他网站的工作方式（除了单个文件名的模糊性之外，不存在任何隐私或安全）。
The simplest and easiest solution is just to name your S3 assets with random, unguessable filenames, and then only expose the secret URLs to the people who should have access.
This is how Facebook photos and many other sites work (there is no privacy or security beyond the obscurity of the individual filenames).
如果您使用回形针，则可以通过使 url 过期来限制对存储在 Amazon S3 上的对象的访问。 （如果您不介意使用过期的网址）
这是来自 GitHub 上thoughtbot/paperclip 的 Wiki
https://github.com/thoughtbot/paperclip/wiki/Restricting-Access-to-Objects-Stored-on-Amazon-S3
另外，还有该页面底部的一些有用链接您可能不想错过。
If you use paperclip, you can restrict access to objects stored on Amazon S3 by expiring url. (if you don't mind to use expiring url)
Here is the Wiki from thoughtbot/paperclip on GitHub
https://github.com/thoughtbot/paperclip/wiki/Restricting-Access-to-Objects-Stored-on-Amazon-S3
Also, there are some helpful links at the bottom of that page which you might not want to miss.
也许我对您想要完成的任务感到困惑，但 S3 具有访问权限，需要在您向用户提供的 url 中包含加密密钥。使用 aws-s3 gem 时，默认启用此选项。因此，除非用户使用嵌入了加密密钥的链接，否则您应该无法访问这些文件。这需要您确保该文件设置为仅授权访问。
有关 gem 的更多信息，请访问 http://amazon.rubyforge.org/。查找与访问控制相关的文档（我认为“authenticated_read”就是您想要的）。
Maybe I'm confused as to what you are trying to accomplish, but S3 has permissions access that require an encryption key to be in the url you provide the user. When using the aws-s3 gem, this option is enabled by default. Therefore, you should not be able to access the files unless the user is using the link with the encrypted key embedded in it. This would require you to make sure that the file is set to authorized access only.
More info can be found http://amazon.rubyforge.org/ about the gem. Look for documentation related to Access control (I think "authenticated_read" is what you want).