I'm using Amazon S3 to host some assets (mostly images) on a small project. I'm trying to find a way to prevent leeching (which can be very serious should someone tried to use a network of bots to shoot my bill to the stars).

My current approach is using this policy:

   {
  "Version": "2008-10-17",
  "Id": "",
  "Statement": [
    {
      "Sid": "Allow in my domains",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::BUCKET/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": [
            "http://www.myproject.com/*"
          ]
        }
      }
    },
    {
      "Sid": "Deny access if referer is not my sites",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::BUCKET/*",
      "Condition": {
        "StringNotLike": {
          "aws:Referer": [
            "http://www.myproject.com/*"
          ]
        }
      }
    }
  ]
}

The issue is that by applying such policy, social network sharing services as Facebook's and Google Plus' becomes unable to reach my images to compose the 'post'. Both Facebook and Google reach for the shared content and transfer a generated thumbnail from the content image to their own servers (Facebook uses Akamai, tbw)...

Does any of you have an idea of which hosts those two social networks uses to retrieve files so I can grant them access?

  • 1
    Doesn't this mean the image will be blocked if the referrer is blank? – DisgruntledGoat Jan 8 '15 at 13:42

Facebook uses the facebookexternalhit user agent

facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"

Google+ uses a user agent containing "Google"

Google (+https://developers.google.com/+/web/snippet/)

You should grant them access by user agent.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.