php - Amazon S3 presigned url - Invalidate manually or one time upload -

-

i using s3 accept direct uploads user s3. therefore using pre-signed urls.

after successful upload, aws lambda make sure file upload image, , client tell server has finished uploading.

then server check if file exists in s3 (if lambda detects invalid image, deletes it). if does, rest of application logic follow.

however, there loophole in mechanism. user can use same url upload malicious file after telling server has finished uploading (and passing valid file).

lambda still delete file, server think file exists whereas not.

is there way generate one-time upload pre-signed url, or possible forcefully invalidate url generated has not yet expired?

turning answer...

once file uploaded, have lambda move (using copy object api), i.e. uploads/123.png received/123.png or similar.

if malicious user attempts re-use signed url, it'll go uploads/123.png. worst-case, lambda checks again , rejects new file. since server's looking in received/ instead of uploads/ files process, we've rendered things safe.


Comments

Post a Comment

Popular posts from this blog

Why does Go error when trying to marshal this JSON? -

-
i'm trying rather simple example of trying decode json file structs using golang. however, when attempting error that json: cannot unmarshal object go value of type []main.track which don't understand. here's code in question, , json can found here . package main import ( "encoding/json" "fmt" "net/http" "os" ) // tracks group of track types type tracks struct { tracks []track } // track represents singular track type track struct { name string url string artist artist } // artist represents single artist type artist struct { name string mbid string url string } func main() { url := "http://ws.audioscrobbler.com/2.0/?method=geo.gettoptracks&api_key=c1572082105bd40d247836b5c1819623&format=json&country=netherlands" response, err := http.get(url) if err != nil { fmt.printf("%s\n", err) os.exit(1) } de
Read more

Django REST Framework perform_create: You cannot call `.save()` after accessing `serializer.data` -

-
i have following viewset: class artistprofileviewset(viewsets.modelviewset): queryset = artistprofile.objects.all() serializer_class = artistprofileserializer def perform_create(self, serializer): if serializer.is_valid(): serializer.save() with following serializers: class simpleartisttrackserializer(serializers.hyperlinkedmodelserializer): class meta: model = artisttrack fields = (...my fields...) class artistprofileserializer(serializers.hyperlinkedmodelserializer): owners = userserializer(many=true, required=false) tracks = simpleartisttrackserializer(many=true, required=false) class meta: model = artistprofile fields = (...my fields...) i getting following error: assertionerror: cannot call `.save()` after accessing `serializer.data`.if need access data before committing database inspect 'serializer.validated_data' instead. i don't see editing serializer.data object. th
Read more

python - Pygame. TypeError: 'pygame.Surface' object is not callable -

-
i new python, pygame, , coding in general. i not know why code getting: "typeerror: 'pygame.surface' object not callable" and black screen. here code: import pygame ptypeerror: 'pygame.surface' object not callableygame.init black = (0,0,0) white = (255,255,255) red = (255,0,0) green = (0,255,0) blue = (0,0,255) char_sprite = pygame.image.load("man.png") display_height = 800 display_width = 1000 dead = false framerate = 60 game_display = pygame.display.set_mode((display_width,display_height)) pygame.display.set_caption("tiny fighter") clock = pygame.time.clock() def char(x,y): game_dispaly.blit(char_sprite,(x,y)) x= display_width / 2 y= display_height / 2 while not dead: event in pygame.event.get(): if event.type == pygame.quit: dead = true game_display.fill(green) char_sprite(x,y) pygame.display.update() clock.tick(framerate) pygame.quit() quit() full traceback:
Read more