# How to limit Amazon S3 access to my app's pages only (i.e. no hot-linking)?

**URL:** <https://www.ruby-forum.com/t/how-to-limit-amazon-s3-access-to-my-apps-pages-only-i-e-no-hot-linking/118124>\
**Category:** Rails\
**Created:** [October 24, 2007, 2:44am UTC](https://www.ruby-forum.com/t/how-to-limit-amazon-s3-access-to-my-apps-pages-only-i-e-no-hot-linking/118124 "2007-10-24T02:44:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rohit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@rohit](https://www.ruby-forum.com/u/rohit)\
**Post date:** [October 24, 2007, 2:44am UTC](https://www.ruby-forum.com/t/how-to-limit-amazon-s3-access-to-my-apps-pages-only-i-e-no-hot-linking/118124/1 "2007-10-24T02:44:26Z")

</div>

Hey there,

I want to stream my app’s media from Amazon S3. I’ve gotten the  
basics down, having uploaded files, set their permissions for public  
access, and now can use their S3 URLs wherever I need them.

My question is this: can I restrict access to my S3 files to only  
within the context of the pages that my application serves? I want to  
avoid people just looking at the source from the browser and  
downloading my content, i.e. hot-linking. Can I make my app be the  
only authorized requester of files?

I know I can create expiring links with S3, and use ‘Query String  
Authentication’, but I am unsure how either technique would help me.  
it also doesn’t seem that S3’s ACL can work for me, either. Right  
now, I have fields in my DB that contain the URLs for my content that  
are just written in HTML to the pages.

Any ideas? Thanks so much for any help or insights.

-Rohit

---

<div class="post-metadata">

**Author:** ![rohit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@rohit](https://www.ruby-forum.com/u/rohit)\
**Post date:** [October 24, 2007, 6:48pm UTC](https://www.ruby-forum.com/t/how-to-limit-amazon-s3-access-to-my-apps-pages-only-i-e-no-hot-linking/118124/2 "2007-10-24T18:48:40Z")

</div>

I found this post on the S3 developer forums that sheds some light on  
this issue:

> **[Forums](https://repost.aws/forums?origin=thread.jspa&messageID=62081&)**
>
> Forums