s2Member Cloudfront integration Making Private files Public!!

  • waynmeyer

    (@waynmeyer)


    9 years, 7 months ago

    I have integrated s2member with s3 and cloudfront exactly as your video. Everything works fine however im finding two massive glitches that im unable to debug. please see my errors below.

    1: When i integrate cloudfront, then any download file downloads with the static url from cloudfront. However i took this url and noticed that even if i was not logged in and not even a member, then this url will work to download. Which means no security for files at all. So i tested on my mobile and also was able to download the file from my private bucket. Cloud this be permissions of bucket?

    2: I have rtmp streaming working perfect on desktops, however on mobiles it does not work. iphone 5 tested. Also the issue is when i used the html5 fallback method, then the pc shows the html5 and not the object which means its easy to download the mp4 and or share it with public and they have access. so no security, as i see that the fallback method should only on mobiles.

    Anyone else having these issues? If i disable cloudfront, then everything works spot on, however i cant stream 🙁 so its a catch22 for me now!!

    Do you think it could be my bucket permissions? I know this wont fix my issue of mobile support, but maybe security?

    Kind regards

    https://wordpress.org/plugins/s2member/

Viewing 6 replies - 1 through 6 (of 6 total)
  • KTS915

    (@kts915)

    9 years, 7 months ago

    Can’t help on (2) — no experience with RTMP streaming.

    But on (1), have you put your files in the appropriate protected sub-folders? And have you enabled Alternative View Protection?

    Thread Starter waynmeyer

    (@waynmeyer)

    9 years, 7 months ago

    yes i have put files in protected folders. How do i enable alternative view protection?

    KTS915

    (@kts915)

    9 years, 7 months ago

    It’s on the Restriction Options page.

    Thread Starter waynmeyer

    (@waynmeyer)

    9 years, 7 months ago

    Ahh i see, that wont help though will it? None of those settings apply for this error according to their descriptions, my issue is actually that cloudfront static url is making my url public. I have a feeling its permissions in cloudfront AWS console. just need some advice

    Thread Starter waynmeyer

    (@waynmeyer)

    9 years, 7 months ago

    You can read more here : http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

    But im worried about the actual permissions as it is auto configured by s2member 🙁

    Typically, if you’re using an Amazon S3 bucket as the origin for a CloudFront distribution, you grant everyone permission to read the objects in your bucket. This allows anyone to access your objects using either the CloudFront URL or the Amazon S3 URL. CloudFront doesn’t expose Amazon S3 URLs, but your users may have those URLs if your application serves any objects directly from Amazon S3 or if anyone gives out direct links to specific objects in Amazon S3.

    If you want to use CloudFront signed URLs to provide access to objects in your Amazon S3 bucket, you probably also want to prevent users from accessing your Amazon S3 objects using Amazon S3 URLs. If users access your objects directly in Amazon S3, they bypass the controls provided by CloudFront signed URLs, including control over when a URL expires and control over which IP addresses can be used to access the objects. In addition, if users access objects using both CloudFront URLs and Amazon S3 URLs, CloudFront access logs are less useful because they’re incomplete.

    You restrict access to Amazon S3 content by creating an origin access identity, which is a special CloudFront user. You change Amazon S3 permissions to give the origin access identity permission to access your objects, and to remove permissions from everyone else. When your users access your Amazon S3 objects using CloudFront URLs, the CloudFront origin access identity gets the objects on your users’ behalf. If your users try to access objects using Amazon S3 URLs, they’re denied access. The origin access identity has permission to access objects in your Amazon S3 bucket, but users don’t.

    KTS915

    (@kts915)

    9 years, 7 months ago

    But since s2 automatically knows that your files are being stored remotely, shouldn’t AFP do the job you’re asking? Have you tried it?

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘s2Member Cloudfront integration Making Private files Public!!’ is closed to new replies.