Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Apparently I have spent a gazillion hours trying the same with MP3 files for my web site. To answer:</p> <p>1) Not too complicated a task. (despite my Gazillion hrs)</p> <p>2) Do not sign URLs from within Flash. Use an Hosted PHP file to which you can make an AJAX request to obtain signed URLs. For this the directory structure of ur S3 bucket must have a consistent pattern that makes the file location, given some input, programatically determinable. </p> <p>I don't this this is a process that can be bypassed. URL Signing must only be done server side and never client side. Let me know if you want to see my AJAX sample code. Ill paste it here for you</p> <p>3) The signing process uses a minimum of three variables to create a signature - the timestamp, file location (bucket/folder/floder/file) , S3 Secret Key . Hence, Each request for a file shall have a separate signature. The signed URLs should have a very limited validity (say 10 seconds). Users who can find out the URL withse those 10 seconds shall be able to download the file.</p> <p>Having signatures that vary with timestamp alone might defeat (largely if not fully) the whole purpose of having signed URLs. </p> <p>To sign URLs, use the script below. It works like charm and would have save me a lot of hours had I got it on time. Also look at point 5 below for additional security.</p> <p><a href="http://www.richardpeacock.com/blog/2010/07/amazon-aws-s3-query-string-authentication-php" rel="nofollow">http://www.richardpeacock.com/blog/2010/07/amazon-aws-s3-query-string-authentication-php</a></p> <p>4) For some reason FLASH players are not playing Signed S3 URLs for MP3 Files. I think (GUESS) they ignore the part of the url once the .mp3 extention in the URL is read. Thus the query string part of the URL is ignored by the player and it can't read the file. They play publically reabable files in my S3 Bucker though. I have been using silverlight for my site amd am desparately using for a FLASH solution. If that be the reason protected FLV Files wont play either. In this case you will have to proxy the whole file to your client insted of the URL alone. A solution I am trying to avoid. </p> <p>5) to further protect ur URLs, obfuscate them using one or more of the methords in the link below. They are very simple. </p> <p><a href="http://www.pc-help.org/obscure.htm" rel="nofollow">http://www.pc-help.org/obscure.htm</a> </p> <p>6) Further, your security approach must be to be initiate playback of the file on the browser before the URL expires. Th expiry time period must be short enough to prevent URL detection before expiry and must be long enough to provide enuf latency to begin playback. This is more or less the crux of reasonably secure streaming using self expiring URLs.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload