1

I realized that after creating a bucket with the default settings anyone who knows the bucket name is able to check for the existence of a file.

Example:

Someone tries the url https://storage.googleapis.com/bucket_name/file_name

If the file doesn't exist the message shown is "The specified key does not exist"

If the file does exist the message is "Anonymous callers do not have storage.objects.get access to object bucket_name/file_name"

This makes easy to discover filenames stored in a bucket, therefore, the privacy of the bucket content is not complete.

I also use S3 storage where the message is "Access denied" for both cases, so there is no way to know if the file is really there.

Is there any way to disable this behavior?

Thanks

4

1 回答 1

0

对不起，但目前没有任何方法可以让这两种情况都“拒绝访问”。

请注意，即使这确实存在，也不一定会阻止定时攻击确定对象是否存在。出于这个原因，建议您不要将敏感数据存储在对象名称中，并且如果确定对象名称的存在对您的业务构成风险，则应混淆对象名称。

于 2016-04-11T19:22:13.057 回答