WordPress短码跳转S3私有文件提示AccessDenied，锚点可正常下载求助

Hey there, let's break down why your shortcode is throwing an AccessDenied error while regular anchor links work with your private S3 bucket. Here are the most likely culprits and actionable fixes:

1. Check Referer Header Mismatch in S3 Bucket Policy #

Your bucket policy restricts access to your domain, right? The key difference between a regular anchor click and your shortcode's auto-triggered download is the Referer header sent to S3.

• First, confirm your bucket policy includes a Referer condition like this (replace with your actual domain):

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::your-bucket-name/*",
        "Condition": {
          "StringLike": {
            "aws:Referer": "https://your-wordpress-domain.com/*"
          }
        }
      }
    ]
  }
  

• Use your browser's DevTools (F12 → Network tab) to compare requests:
  • Click a working anchor link: Look for the Referer header in the request details—it should match your domain.
  • Trigger the shortcode download: Check if the Referer header is missing, or pointing to an unexpected URL. Many auto-triggered JS downloads skip sending this header by default, which S3 blocks.

2. Fix the JS Download Trigger to Mimic User Clicks #

Instead of using window.location.href or window.open to auto-start the download, create a hidden anchor element and simulate a user click. This replicates the behavior of a regular anchor link and ensures the correct Referer header is sent:

// Inside your download page's script (triggered after 2 seconds)
setTimeout(function() {
  // Create a temporary anchor element
  const downloadAnchor = document.createElement('a');
  downloadAnchor.href = '[your-s3-download-url]'; // Replace with your shortcode's dynamic URL
  downloadAnchor.download = 'desired-filename.ext'; // Optional: Set a custom filename
  // Add to DOM and trigger click
  document.body.appendChild(downloadAnchor);
  downloadAnchor.click();
  // Clean up
  document.body.removeChild(downloadAnchor);
}, 2000);

This method is far more likely to pass S3's Referer check because it mimics a real user interaction.

3. Verify Shortcode-Generated S3 URLs Are Valid #

If you're using pre-signed S3 URLs (which you should for private buckets), make sure:

• The shortcode generates the URL dynamically on page load, not from a cached value. WordPress caching plugins might store an expired pre-signed URL, which S3 rejects.
• Copy the shortcode-generated URL directly into your browser's address bar. If it throws AccessDenied, the URL itself is invalid (expired signature, incorrect permissions, or typos). If it works, the issue is definitely with the JS trigger method.

4. Double-Check S3 Object & Bucket Permissions #

While regular anchors work, it's worth ruling out edge cases:

• Ensure the S3 object's ACL doesn't have explicit "Deny" permissions overriding the bucket policy.
• Confirm your bucket policy doesn't have conflicting statements that block the shortcode's request (e.g., forgotten IP restrictions).

内容的提问来源于stack exchange，提问作者Usman Khalid