基于PHP & Nginx生成Signed URL及资源访问权限控制技术问询

Hey Abdul, great question! Signed URLs are a solid approach for securing media resources, and implementing them on your own site is totally doable—you don't need a third-party CDN like AWS S3. Let's walk through how to build this, plus cover some alternatives you might want to consider.

How Signed URLs Work (Quick Primer) #

At their core, signed URLs add two critical pieces to a regular resource URL:

• An expiration timestamp: Ensures the URL becomes invalid after a set time.
• A cryptographic signature: Generated using a secret key, tied to the resource path and expiration time. If anyone tampers with the URL (changes the path, expiration, etc.), the signature won't match, and your server can reject the request.

Implementing Signed URLs on Your Own Site #

Below are practical code examples for two popular backend stacks—pick the one that matches your tech stack, or adapt the logic to your framework.

1. Node.js + Express Example #

We'll use Node's built-in crypto module (no external dependencies needed):

First, create a utility to generate signed URLs:

const crypto = require('crypto');
const SECRET_KEY = 'your-strong-secret-key-keep-this-safe'; // Store this in env vars!

// Generate a signed URL for a resource
function generateSignedUrl(resourcePath, expiresInSeconds = 3600) {
  const expiration = Math.floor(Date.now() / 1000) + expiresInSeconds;
  // Create a string to sign: combine resource path and expiration
  const signString = `${resourcePath}:${expiration}`;
  // Generate HMAC-SHA256 signature
  const signature = crypto
    .createHmac('sha256', SECRET_KEY)
    .update(signString)
    .digest('hex');
  // Build the final URL (adjust base URL to match your domain)
  return `https://your-domain.com/media${resourcePath}?exp=${expiration}&sig=${signature}`;
}

Then, add a middleware to validate incoming requests for media resources:

function validateSignedUrl(req, res, next) {
  const { exp, sig } = req.query;
  const resourcePath = req.path;

  // Check if required params exist
  if (!exp || !sig) {
    return res.status(403).send('Invalid request');
  }

  // Check if the URL has expired
  if (Math.floor(Date.now() / 1000) > parseInt(exp)) {
    return res.status(403).send('URL has expired');
  }

  // Re-generate the signature to verify
  const signString = `${resourcePath}:${exp}`;
  const expectedSignature = crypto
    .createHmac('sha256', SECRET_KEY)
    .update(signString)
    .digest('hex');

  // Compare signatures (use timing-safe comparison to prevent timing attacks)
  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSignature))) {
    return res.status(403).send('Invalid signature');
  }

  // All checks passed—serve the resource
  next();
}

// Apply the middleware to your media routes
app.use('/media/*', validateSignedUrl);

2. Python + Flask Example #

Using Python's built-in hmac and hashlib modules:

First, the URL generation utility:

import hmac
import hashlib
import time
from flask import Flask, request, abort

SECRET_KEY = b'your-strong-secret-key-keep-this-safe' # Store in env vars!

def generate_signed_url(resource_path, expires_in_seconds=3600):
    expiration = int(time.time()) + expires_in_seconds
    # String to sign: resource path + expiration
    sign_string = f"{resource_path}:{expiration}".encode('utf-8')
    # Generate HMAC-SHA256 signature
    signature = hmac.new(SECRET_KEY, sign_string, hashlib.sha256).hexdigest()
    # Build the final URL
    return f"https://your-domain.com/media{resource_path}?exp={expiration}&sig={signature}"

Then, the validation middleware:

app = Flask(__name__)

def validate_signed_url():
    exp = request.args.get('exp')
    sig = request.args.get('sig')
    resource_path = request.path

    if not exp or not sig:
        abort(403, description="Invalid request")
    
    # Check expiration
    if int(time.time()) > int(exp):
        abort(403, description="URL has expired")
    
    # Re-generate signature for verification
    sign_string = f"{resource_path}:{exp}".encode('utf-8')
    expected_signature = hmac.new(SECRET_KEY, sign_string, hashlib.sha256).hexdigest()

    # Timing-safe comparison
    if not hmac.compare_digest(sig, expected_signature):
        abort(403, description="Invalid signature")

# Apply middleware to media routes
@app.before_request
def before_media_request():
    if request.path.startswith('/media/'):
        validate_signed_url()

Alternatives to Signed URLs #

While signed URLs are great for many cases, here are some other approaches depending on your use case:

• Temporary JWT Tokens + Reverse Proxy: Instead of signing the URL, issue short-lived JWT tokens to authorized users. When a user requests a resource, they include the JWT in the header. A reverse proxy (like Nginx) or your backend validates the JWT before serving the resource. This works well if users need to access multiple resources without generating a new signed URL each time.
• Session-Based Access Control: If your users are already logged in via sessions (e.g., cookies), you can check the user's session and permissions directly in the resource route. For example, verify the user owns the uploaded media or has been granted access. Note: This doesn't prevent users from sharing the URL with others who are logged in, so it's better for internal or private systems.
• IP-Locked URLs: Combine signed URLs with the user's IP address (include the IP in the signed string). This adds an extra layer of security, but can be problematic if users switch networks (e.g., mobile users).

Key Best Practices #

• Keep your secret key safe: Store it in environment variables, never hardcode it or expose it to the frontend.
• Choose appropriate expiration times: Balance security (shorter expiration) and user experience (longer expiration for resources users might share temporarily).
• Use strong hashing algorithms: Stick to HMAC-SHA256 or higher—avoid MD5 or SHA1, which are insecure.
• Return generic error messages: Don't tell attackers why their request failed (e.g., "invalid signature" vs "expired URL")—just return a 403 Forbidden to avoid leaking information.

内容的提问来源于stack exchange，提问作者Abdul Jabbar