Take the 2-minute tour ×

I want to use Amazon S3/CloudFront to store flash files. These files must be private as they will be accessed by members. This will be done by storing each file with a link to Amazon using a mysql database. My problem is this... A high level member who has access to lots of flash files and content can simply find out the URL and then browse to it using the address bar, and share this with other members. As they are both using the http protocol, does this mean I can't prevent this?

I thought about htaccess but as its Amazon's own server I'm not sure. I looked at the Access Control documentation but it was a bit unclear.

Also while im here does anyone know a working method for stopping the flash media from showing up in the firefox Tools > Page Info > Media? I saw a post on here about a dummy loader but they don't work as pointed out because you can just download and change the file extension. There are sites out there that do it but I wan't to avoid expensive software licences etc.

Sorry thats so lengthy :) Big thanks!

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You can maintain ACL at your end and make every file on S3 private. Check if a particular member has access to some file, if yes then generate the signed URL for that particular file(you can set the expiry time of the link) at application end and give to user.

share|improve this answer
Thanks for the reply. So the link will be generated by Amazon? As an example, would I check the user has bought the file on my end and then re-direct the page to some sort of S3 url generator scrip? Or will it be done via a php scrip? Just not sure what to store in the database. I was going to store the filename but not sure of the process. –  whamo Nov 23 '09 at 23:08
Store the file name in the DB, then check if member has access to the file, then generate the signed URL (you can do it in php, undesigned.org.za/2007/10/22/amazon-s3-php-class/…) then either redirect user to this URL or use this URL at the user end to do something. Make sure to provide lifeTime to getAuthenticatedURL, otherwise the signed URL will work for 24 hours. –  bhups Nov 24 '09 at 9:57
That sounds like the business, cheers for your pointers mate –  whamo Nov 24 '09 at 22:21

Your Answer


