Post by @esparta@ruby.social

Presigned URLs are technically a security vuln, by @cadey
https://www.tigrisdata.com/blog/presigned-urls-security-vuln/

> Replayable auth tokens are the textbook way to create vulnerable systems, but Tigris ships them as a first-class feature with presigned URLs and so does every other object storage system on the planet. However this isn’t an oversight because presigned URLs turn a weakness into a feature.

> Replay attacks are a real problem and the classic fix is miserable

Presigned URLs are technically a security vuln | Tigris Object Storage

Presigned URLs are replay attacks you commit on purpose. How SigV4 signs the clock, what a presigned URL grants on Tigris storage, and what it costs you.

Xe :verified:

@cadey@pony.social 3 hours ago

@esparta Hope you enjoyed that one!

Esparta :ruby:

@esparta@ruby.social 2 hours ago

@cadey a did enjoy your post, as usual.
It also helped me to explain to a colleague why we shouldn't re-implement sigv4 as a project was intending to do - to combat some bots and their misbehaviour s

Xe :verified:

@cadey@pony.social 59 minutes ago

@esparta I'm actually working on a blogpost where I reimplement (the server side of) SigV4 so that I can reuse Tigris' existing API authentication layer. When I implemented it in my open source experimentation repo I've found it sucks way less than you'd think.