AWS S3 和手机架构
这里是：
我有一个带有文件夹和移动应用程序的 AWS S3 存储桶。
我想在这两者之间创建一个 servlet，其架构为：
Phone < > Servlet < > S3
我不希望手机直接访问 S3，因此 servlet 将具有访问密钥和秘密密钥，以便使用凭据向 S3 存储桶上传和下载。
我希望手机首先预览图片，这意味着他加载图像网址，例如 https:// /s3.amazon.com/abc/abc.jpg 并将其缓存在手机中。之前我将存储桶策略设置为公共，以便任何人都可以访问该图片，但现在我想保护它，因此需要在中间添加 servlet 层。
我的想法是让手机向 servlet 发送 POST 请求。 对电话用户进行身份验证后，Servlet 将使用凭据从 S3 存储桶下载文件。然后，Servlet 将对文件进行 Base64 编码并将其发送到手机进行显示。
我的问题是，有没有更好的方法来处理这个问题？例如： 向 servlet 发送 POST。 Servlet 进行身份验证并以某种方式使用凭据，将手机重定向到存储桶上的图像 url 链接，以便我可以跳过 Base64 编码部分。
或者有更好且正确的方法来做到这一点？谢谢！
Here goes:
I have a AWS S3 bucket with a folder and a mobile application.
I want to create a servlet in between these 2 such that the architecture is:
Phone < > Servlet < > S3
I don't want the phone to have direct access to the S3 and so the servlet will have the Access Key and Secret Key to do the uploading to and downloading from the S3 bucket using the credentials.
I want the phone to have a preview of the picture first, meaning he loads the image url like https://s3.amazon.com/abc/abc.jpg and and caches it in the phone. Previously I set the bucket policy to public so anyone has access to the picture but now I want to secure it, thus the additional layer of the servlet in between.
My idea is to have the phone send a POST request to the servlet.
Servlet after authenticating the phone user will use the credentials to download the file from the S3 bucket. Servlet will then base64 encode the file and send it to the phone for display.
My question is, is there a better way to handle this? For example:
Send a POST to the servlet. Servlet authenticates and somehow using the credentials, redirects the phone to the image url link on the bucket so that I can skip the base64 encoding portion.
Or is there a better and proper way to do this? Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Amazon S3 具有“预签名 URL”功能，允许您构建 URL 来访问受其他保护的内容，但有时间限制。在其文档页面上，查找“查询字符串请求身份验证替代方案” "
您可以让您的 Servlet 生成签名 URL 并将其作为重定向提供给客户端。
Amazon S3 has a "Pre-signed URL" feature which allows you to build a URL to access otherwise-protected content, with a time limit. On their documentation page, look for "Query String Request Authentication Alternative"
You can have your servlet generate the signed URL and supply it to the client as a redirect.
请记住，预签名 URL 必须有一个到期日期。当我不关心以后扩展或删除访问权限时，它们是一个不错的选择。为了实现全面、即时的控制，我选择了中间服务器来处理 S3“家务”。
Keep in mind that pre-signed uRLs must have an expiration date. When I don't care about expanding or removing access at a later date, they are a great option. For full, immediate control, I've opted for intermediary servers to handle the S3 "housework."