3 ms·
Until the author fixes the post, this is what they're talking about: https://cloud.google.com/storage/docs/access-control/signed-urls https://cloud.google.com/s
by telotortium 2y ago
Until the author fixes the post, this is what they're talking about: https://cloud.google.com/storage/docs/access-control/signed-urls https://cloud.google.com/storage/docs/access-control/signed-.... Essentially, it ensures that a URL is invalid unless the server signs it with a secret key controlled by the server, which means that clients can't access your assets just by guessing the URL. In addition to signing the URL, the signature can contain metadata such as permissions and expiration time.
- riedel 2y agoIs there any advantage over JWT other than one can put the token into the URL itself (which is technically also possible with JWT I guess, with the downside that it will be probably exposed in logs, etc.)?
- kijin 2y agoSigned URLs work with dumb storage such as Amazon S3 and Google Cloud Storage. You might want to use JWT to authenticate someone before handing out a signed URL, though.
- inopinatus 2y agoThe signature is verified by the origin bucket/cdn endpoint, so it's in the format used by the applicable public cloud, without depending on any application-specific cookie or bearer values, and with CORS/CSP interactions you can easily reason about. Signature values could appear in the logs the cloud provider writes, but won't be in your application logs unless you, for example, specifically write out the Location of a 30x redirect (which would be relatively uncommon), and in any case the ephemerality makes them basically uninteresting.
- jacobr1 2y agoThese came out before JWTs gained broad adoption. They are accomplishing the same technical objective via a different implementation.