# Amazon S3 authentication patch **URL:** \ **Category:** NGINX\ **Created:** [February 4, 2010, 9:33am UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880 "2010-02-04T09:33:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Vicente\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/fbc32d/32.png) [@Vicente\_A](https://www.ruby-forum.com/u/Vicente_A)\ **Post date:** [February 4, 2010, 9:33am UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880/1 "2010-02-04T09:33:56Z")
Hi I’ve modified the proxy module to be able to authenticate with Amazon S3. It also supports the secure download patch by removing the trailing ticket (MD5/timestamp) from the URL. The rationale behind this is: we’re using S3 to offload all our app’s static files but need some of them to be public (images) and some private (downloads for registered users). We’re using nginx as a proxy to S3 to cache requests and minimize the per-GET cost of S3, so our first approach was a security through obscurity one: as the final user only sees our URL and not the real bucket’s URL, we could make the whole bucket public and use the secure download patch just on some locations, so that the user couldn’t download files from there. But this protection was only on our server, if some user guessed our S3 bucket he could download everything directly from S3. With this patch we can make parts of the bucket private, and authenticate with S3 so that only our servers are able to download them. And it plays nice with the secure download patch, so the files are secure both on S3 and through our proxy. Please find the patch attached. This is my first attempt at hacking more than a couple lines into nginx, so I’m sure some code cleanup might apply. I particularly don’t like using static char arrays (should move to ngx\_copy and such) and couldn’t get ngx\_conf\_set\_flag\_slot to work for config options. Config syntax is as follows: ``` location /private/ { proxy_pass ``` [http://BUCKET.s3.amazonaws.com/private/](http://BUCKET.s3.amazonaws.com/private/); proxy\_s3\_auth on; proxy\_s3\_secure\_download on; # optional if you’re also using secdownload proxy\_s3\_bucket BUCKET; proxy\_s3\_user S3\_USER\_ID; proxy\_s3\_pass S3\_PASSWORD; } Any comments, suggestions, and code corrections are welcome. 🙂 Regards ---
**Author:** ![Vicente\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/fbc32d/32.png) [@Vicente\_A](https://www.ruby-forum.com/u/Vicente_A)\ **Post date:** [February 4, 2010, 1:11pm UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880/2 "2010-02-04T13:11:40Z")
Hello! On Thu, Feb 04, 2010 at 09:33:21AM +0100, Vicente A. wrote: > I’ve modified the proxy module to be able to authenticate with > Amazon S3. It also supports the secure download patch by > removing the trailing ticket (MD5/timestamp) from the URL. I believe better aproach would be to build separate module able to calculate required hash and then use proxy\_set\_header with appropriate variable. Note well: rigth now this should be possible with embedded perl. Though I think having embedded perl compiled into nginx just for this isn’t a good idea, and C implementation whould be safer and faster. […] Maxim D. ---
**Author:** ![Vicente\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/fbc32d/32.png) [@Vicente\_A](https://www.ruby-forum.com/u/Vicente_A)\ **Post date:** [February 4, 2010, 4:44pm UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880/3 "2010-02-04T16:44:11Z")
On Thu, Feb 4, 2010 at 4:10 AM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > appropriate variable. > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx) For whatever it’s worth, I agree that we should make things as easy to combine as possible, rather than making monolithic modules that cover all cases. Small and light 😃 – Merlin ---
**Author:** ![Vicente\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/fbc32d/32.png) [@Vicente\_A](https://www.ruby-forum.com/u/Vicente_A)\ **Post date:** [February 5, 2010, 9:21am UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880/4 "2010-02-05T09:21:10Z")
Hi > > I believe better aproach would be to build separate module able to > > calculate required hash and then use proxy\_set\_header with > > appropriate variable. > > For whatever it’s worth, I agree that we should make things as easy to > combine as possible, rather than making monolithic modules that cover > all cases. I guess you’re both right, but I wouldn’t know how to do that right now, I’m new to nginx internals. 🙂 I needed this feature ASAP and this approach was easier. I might rework it into a separate module as time permits. Regards ---
**Author:** ![Vicente\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/fbc32d/32.png) [@Vicente\_A](https://www.ruby-forum.com/u/Vicente_A)\ **Post date:** [December 26, 2010, 7:50am UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880/5 "2010-12-26T07:50:15Z")
On Feb 05, Vicente A. wrote: > I guess you’re both right, but I wouldn’t know how to do that right > now, I’m new to nginx internals. 🙂 I needed this feature ASAP and > this approach was easier. > > I might rework it into a separate module as time permits. Here is a module that provides basic S3 proxying without patching any of the existing files: [GitHub - anomalizer/ngx\_aws\_auth: nginx module to proxy to authenticated AWS services · GitHub](https://github.com/anomalizer/ngx_aws_auth) ---
**Author:** ![Vicente\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/fbc32d/32.png) [@Vicente\_A](https://www.ruby-forum.com/u/Vicente_A)\ **Post date:** [December 20, 2010, 3:59pm UTC](https://www.ruby-forum.com/t/amazon-s3-authentication-patch/182880/6 "2010-12-20T15:59:18Z")
Vicente, We’ve been using this but we’re looking at moving to newer versions of nginx - have you released any patches for any versions beyond 0.7.64? Thanks, Nicholas Posted at Nginx Forum: > **[Re: Amazon S3 authentication patch](https://forum.nginx.org/read.php?2,50336,159951#msg-159951)** > > Hi I've modified the proxy module to be able to authenticate with Amazon S3. It also supports the secure download patch by removing the trailing ticket (MD5/timestamp) from the URL. The rationale behind this is: we're using S3 to offload all our...