Ravi Sir's Cards › AWS
Presigned URL and Referer pitfalls
This revision card explains Presigned URL and Referer pitfalls. A presigned URL is temporary access — treat it like a secret. It describes bucket conditions still apply; aws:Referer is spoofable and weak as primary auth. The how-to section notes short expiry; HTTPS; prefer OrgID/OAC over Referer allowlists. An example on the card is fatima Khan shows a stolen http presign failing SecureTransport Deny.
Read card text
What this card says
Why do we need it?
A presigned URL is temporary access — treat it like a secret.
presigned URL
What is it?
Bucket conditions still apply; aws:Referer is spoofable and weak as primary auth.
Referer
How to do it
Short expiry; HTTPS; prefer OrgID/OAC over Referer allowlists.
Example
Fatima Khan shows a stolen http presign failing SecureTransport Deny.