How do I prevent hotlinking on Amazon S3 without using signed URLs?

Question

Is there any way I can prevent hotlinking on Amazon S3 without using signed URLs?

Nonconformity

Answer 1

By setting up the right S3 bucket policy, you can add referral policy to prevent the hotlink.

http://s3browser.com/working-with-amazon-s3-bucket-policies.php

Capparidaceous

Please post an answer here, rather than linking to an answer. – Ashkhabad

Answer 2

You need a bucket policy that both allows referrers from your domain(s) and denies referrers who are not from your domains. I've found that images can be hotlinked if you don't include the explicit denial - many guides and examples just give the allow policy and don't mention the deny part.

Here's my policy, just change BUCKET-NAME and YOUR-WEBSITE to your own details:

{
  "Version": "2008-10-17",
  "Id": "",
  "Statement": [
    {
      "Sid": "Allow in my domains",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::BUCKET-NAME/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": [
            "http://www.YOUR-WEBSITE.com/*"
          ]
        }
      }
    },
    {
      "Sid": "Deny access if referer is not my sites",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::BUCKET-NAME/*",
      "Condition": {
        "StringNotLike": {
          "aws:Referer": [
            "http://www.YOUR-WEBSITE.com/*"
          ]
        }
      }
    }
  ]
}

Ashkhabad

Thanks for this. This really helped me and worked well. My only suggestion is that perhaps you also just add an entry for "YOUR-WEBSITE.com*" to the answer just to cover all bases as that's where my hiccups were. Cheers for the perfect script though. – Isaak

This works great but how do I allow empty referrers? When linking to images via CSS the referrer is empty and images are not displaying. – Deciare

Perfect! You saved me – Bewray

Answer 3

It's in their official docs

Change examplebucket to your bucket name, and example.com to your domain.

"Version":"2012-10-17",
"Id":"http referer policy example",
"Statement":[
  {
    "Sid":"Allow get requests originating from www.example.com and example.com.",
    "Effect":"Allow",
    "Principal":"*",
    "Action":"s3:GetObject",
    "Resource":"arn:aws:s3:::examplebucket/*",
    "Condition":{
      "StringLike":{"aws:Referer":["http://www.example.com/*","http://example.com/*"]}
    }
  }
]
}

Demibastion

Answer 4

I use Apache RewriteMap to remap relative links to select file extensions -- *.jpg, *.gif, *swf, *.fla to Cloudfront. Basically makes the url of your images present as relative links to your site. It doesn't prevent discovery of the S3/cloudfront url totally, just adds a layer of difficulty for the would be thief.

Might be worth a try, apply the hotlink restrictions via htaccess with the above method in place. I haven't tried it myself.

Folketing

Huh? Doesn't that mean that every image request has to go to your server before it can go to the CloudFront server? If so, doesn't that defeat the point of using a CDN? (It wouldn't for really big files like video, but for images?) – Portray

The request will hit your web server and the browser is told where it should go to fetch the file, but the browser's history is never updated with the actual URL to the CDN. This is essentially the same trick behind "routes" in most front end controller frameworks, but in this case the request is never forwarded to the application server, only Apache. – Loferski

@Claude, if instead of browser, download-managers are used, or something like curl / wget is used, won't the redirect be transparent, and thus be a way to enable hotlinking ? – Degrading

@icarus74 Sorry for the late reply. Sure, any tool capable of browsing and understanding HTTP codes should be able to follow the redirect to the CDN in effect negating the effect of the rule suggested by maddie. The best course of action is to protect your CDN from unwanted requests by setting bucket policies as suggested by Robert Mao's link above. – Loferski

Answer 5

There's a good tutorial here. Make sure to check out the comments, since there's a whitespace character in the website's code that causes the solution not to work.

Almedaalmeeta

Answer 6

Hotlinking is one of the reasons Amazon created Cloudfront. Cloudfront is much much faster to. I did a writeup on it you can look at here.

http://blog.sat.iit.edu/2011/12/amazon-aws-s3-vs-cloudwatch-performance-grudgematch/

edit: S3 and Cloudfront both use the same type of bucket policy to make sure the request comes from the correct url. Cloudfront is still faster though.

Option

Cloudfront doesn't prevent hotlinking or respect S3 policies – Ashkhabad

Answer 7

Not really. You could run an EC2 instance and proxy through that.

Necroscopy

uhhhhh. no. that defeats the purpose of a CDN. – Attribution