Question

Serve Private Spaces Object to Browser via CDN

I am trying to access files uploaded to my Spaces bucket. They are private and associated with my users account. I authenticate on my server and was hoping to redirect to a URL where they can see the file.

I have this working with a pre-signed getObject URL. However, I would really prefer to gain the benefits of serving my files from the CDN. Here is what I am doing successfully now:

AWS.config.update({                                                    
  accessKeyId: KEY,                                                    
  secretAccessKey: SECRET,                                             
  region: 'nyc3',                                                      
  signatureVersion: 'v4',                                              
});                                                                    
                                                                       
const options = {                                                      
  signatureVersion: 'v4',                                              
  region: 'nyc3',                                                      
  endpoint: new AWS.Endpoint('nyc3.digitaloceanspaces.com'),
};                                                                     
                                                                       
const client = new AWS.S3(options);                                    
                                                                       
const url = client.getSignedUrl('getObject', {                         
  Bucket: 'myBucket',                                                
  Key: 'theObjectKey',                                                    
  Expires: 5 * 60, // 5 minutes                                        
});                                                                    
                                                                       
res.redirect(url);                                                     

This provides me with a URL like:

https://myBucket.nyc3.digitaloceanspaces.com/THE_OBJECT_KEY?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=CREDENTIAL&X-Amz-Date=20200418T164223Z&X-Amz-Expires=300&X-Amz-Signature=SIGNATURE&X-Amz-SignedHeaders=host

This works well.

Is there any possible way to do this, but using my Spaces CDN? It appears that AWS’ Cloudfront has a completely different lib for signing CF objects (seen here: https://aws.amazon.com/blogs/developer/creating-amazon-cloudfront-signed-urls-in-node-js/).

Any help is much appreciated. Happy to answer any questions.

Subscribe
Share

@bfm I asked DO tech support about the CDN url not expiring, and received this email response on Oct. 28, 2021:

“This is the intended behavior when working with the CDN. After the TTL expires for the object it should re-pull from the origin and update the expiry as expected. The file is still accessible when it is cached on the CDN and will remain so until the CDN cache has refreshed after the URL expires.”

They suggested clearing the cache for the file, which does cause the CDN link to expire as well.

We did some tests, and the following sequence of events does ensure the CDN (or subdomain alias) link will expire:

  1. Generate the expiry link
  2. Access the CDN (or subdomain) link
  3. Clear the CDN cache for the object

To clear the cache using the API: https://docs.digitalocean.com/reference/api/api-reference/#operation/purge_cdn_cache

In practice, for us this will likely look like a user clicking a link to make an ajax request to generate the expiry URL and upon success automatically launching that link, then making a second and sequential ajax request to purge the cache.

I’ve been experiencing the same problem myself. From what I can tell, using the CDN URL does not expire the link properly.

The more I use Spaces the more I’m getting tired of fighting with it.

(Still a HUGE security issue where API keys can not be issued to a single Space… cough cough)

As of 10-10-2020 this is still an issue and no private objects can be served using a custom domain!

I’ve opened this on the django-storages repo but hard to tell whether a fix is possible given its really digital ocean specific.

https://github.com/jschneier/django-storages/issues/944


Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

You can use a pre-signed URL with the CDN as shown in the following documentation

https://www.digitalocean.com/docs/spaces/resources/s3-sdk-examples/#generate-a-pre-signed-url-to-download-a-private-file

Please let me know if this helps you out.

Assuming that you have already enabled your CDN, have you tried using the same URL that getSignedUrl returns, but with the domain changed to point to the CDN?

E.g., instead of:

https://myBucket.nyc3.digitaloceanspaces.com/THE_OBJECT_KEY?X-Amz-Algorithm=...

Try:

https://myBucket.nyc3.cdn.digitaloceanspaces.com/THE_OBJECT_KEY?X-Amz-Algorithm=...