I have images uploaded to S3 and CloudFlare enabled on my site. To my knowledge however, and correct me if I am wrong, the CloudFlare’s hotlink protection does not work due to the images being hosted on a different domain. Any suggestions or example implementations? If the S3 bucket policy is the way to go, I would love to see a .json code example.

You’d want to talk to CloudFlare about that, presumably. There’s nothing Discourse-specific about hotlinking protection on S3.

No, nothing Discourse specific. But many of us rely on S3, so I am interested in how people treat hotlinking — new stuff for me personally, so gotta learn. Useful for anyone using S3, as hotlinking will become an issue. It just a matter of time.

no idea how this works with CloudFlare, but an S3 bucket policy to do this checks the referer. The code below has nothing to do with discourse, it is protecting some files in a special paid section of an old website I have. {"Version":"2008-10-17", "Id":"preventHotLinking", "Statement":[ {"Sid":"1","Effect":"Allow","Principal": {"AWS":"*"},"Action":"s3:GetObject", "Resource":"arn:aws:s3:::downloads.ephotopros.com/*", "Condition":{"StringLike":{"aws:Referer": ["http://dev.ephotopros.com/*","http://ephotopros.com.s3.amazonaws.com/*", "http://ephotopros.com/*","http://s3.amazonaws.com/ephotopros.com/*", "http://localhost:4000/*","http://prolabprints.com/*"]}}}]} The files are served from the main domain, the downloads sub domain is just the bucket name on S3. So the referrer check needs to match where the files should be allowed to be served from. Interesting that it looks like Referer is mis-spelled but that is working code.

[image] rdyar: Interesting that it looks like Referer is mis-spelled but that is working code. HTTP referer | Etymology The misspelling of referrer was introduced in the original proposal by computer scientist Phillip Hallam-Baker to incorporate the "Referer" header field into the HTTP specification. The misspelling was set in stone by the time (May 1996) of its incorporation into the Request for Comments standards document RFC 1945 (which "reflects common usage of the protocol referred to as 'HTTP/1.0'" at that time); document co-author Roy Fielding remarked in March 1995 that "neither one (referer or re When vis...

Best practice to prevent image hotlinking?

Product Support

notriddle (Michael Howell) February 19, 2018, 1:43am 5

Topic		Replies	Views
Download Remote Images with Referer (plugin possible?) Development	13	866	April 1, 2023
S3 links with .gif extension do not display Bug	2	2046	October 18, 2019
Image upload error: The bucket does not allow ACL's Product Support s3	5	1916	June 10, 2022
What are the right settings to use S3 bucket (with non-Amazon URL)? Self-hosting	19	5487	August 25, 2020
Custom avatar cannot be displayed Product Support	0	361	May 14, 2022

Best practice to prevent image hotlinking?

Related topics