Link to data export on S3 does not use CDN URL

[nodomain]

When you are using a CDN URL pointing to S3 and create a data export, the link to the export is generated with the S3 URL and hence the download fails.

Please use the CDN URL there as well.

[pfaffman (Jay Pfaffman)]

That sounds like the desired behaviour. The file will be downloaded only once and is private so there is no reason that it should be cached by the CDN. Right?

[nodomain]

But it breaks if you block direct access to the S3 bucket like we have to do due to company guidelines.

[RGJ (Richard - Communiteq)]

Also mentioned in

• Image lightbox "download" link pointing to S3 bucket not CDN
• Downloads coming from S3 even with DISCOURSE_S3_CDN_URL set
• S3 CDN URL not being used on non-image uploads - #4 by martin

and that last topic explains why this is:

@martin

Basically we are always downloading from S3 with a presigned URL if we are doing a “force download”, which is what happens when we are clicking on the attachment link or clicking on the Download button on an image. This is so the appropriate content-disposition headers can be added:

attachment; filename="#{upload.original_filename}"; filename*=UTF-8''#{upload.original_filename}

I do not think it is possible to make the CDN URL behave in this way? The CDN URL for images is only used when displaying them inline, not when downloading them. Also in the case of secure images and attachments which have a private ACL the presigned URL must always be used.

It would be good if there was an option to proxy those downloads through Discourse though, if only to not expose the S3 bucket to the world.

[nodomain]

In my case I would also be ok with using the signed URL but currently it points directly to the S3 HTTPS URL.