Presigned URLs are technically a security vuln
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Presigned URLs are intentional replay attacks — they take the very weakness SigV4 works hard to eliminate (replayable signatures) and turn it into a feature. SigV4 combats replay attacks by signing the current timestamp into every request, giving signatures a ~15-minute validity window without requiring stateful nonce tracking. Presigned URLs extend this window deliberately (up to 7 days), flattening the entire auth dance into URL query parameters any HTTP client can use. They act as capability grants: whoever holds the URL can perform exactly one type of API call on one object until expiry. Key tradeoffs include no per-URL revocation (only killing the signing key revokes all URLs), unlimited reuse within the expiry window, and URL leakage risk. Understanding these constraints is essential for using presigned URLs safely in application design.
Table of contents
Replay attacks are a real problem and the classic fix is miserable Sign the clock Some thorns have roses What it costs you The hole in the fence is the gate 154.2K Impressions1 Comment