Preventing Amazon Cloudfront hotlinking

Question

I use Amazon Cloudfront to host all my site\'s images and videos, to serve them faster to my users which are pretty scattered across the globe. I also apply pretty aggressi

Answer 1

As of Oct. 2015, you can use AWS WAF to restrict access to Cloudfront files. Here's an article from AWS that announces WAF and explains what you can do with it. Here's an article that helped me setup my first ACL to restrict access based on the referrer.

Basically, I created a new ACL with a default action of DENY. I added a rule that checks the end of the referer header string for my domain name (lowercase). If it passes that rule, it ALLOWS access.

After assigning my ACL to my Cloudfront distribution, I tried to load one of my data files directly in Chrome and I got this error:

Answer 2

How about using Signed cookies ? Create signed cookie using custom policy which also supports various kind of restrictions you want to set and also it is wildcard.

Answer 3

We had numerous hotlinking issues. In the end we created css sprites for many of our images. Either adding white space to the bottom/sides or combining images together.

We displayed them correctly on our pages using CSS, but any hotlinks would show the images incorrectly unless they copied the CSS/HTML as well.

We've found that they don't bother (or don't know how).

Answer 4

You can forward the Referer header to your origin

1. Go to CloudFront settings
2. Edit Distributions settings for a distribution
3. Go to the Behaviors tab and edit or create a behavior
4. Set Forward Headers to Whitelist
5. Add Referer as a whitelisted header
6. Save the settings in the bottom right corner

Make sure to handle the Referer header on your origin as well.

Answer 5

The official approach is to use signed urls for your media. For each media piece that you want to distribute, you can generate a specially crafted url that works in a given constraint of time and source IPs.

One approach for static pages, is to generate temporary urls for the medias included in that page, that are valid for 2x the duration as the page's caching time. Let's say your page's caching time is 1 day. Every 2 days, the links would be invalidated, which obligates the hotlinkers to update their urls. It's not foolproof, as they can build tools to get the new urls automatically but it should prevent most people.

If your page is dynamic, you don't need to worry to trash your page's cache so you can simply generate urls that are only working for the requester's IP.

Answer 6

This question mentioned image and video files.
Referer checking cannot be used to protect multimedia resources from hotlinking because some mobile browsers do not send referer header when requesting for an audio or video file played using HTML5.
I am sure of that about Safari and Chrome on iPhone and Safari on Android.
Too bad! Thank you, Apple and Google.