Cloud Storage customer access best practices

user_8920381 0
Viewed 182

Let's say I have a use case where users can buy mp3 files inside an app. The objects are stored in GCP Cloud Storage . What is the best practice to deliver those objects only to the users that purchased the files?

After researching the topic I came up with three solutions:

  1. Client calls a REST (e.g. one running inside App Engine) service. This service downloads the files from Cloud Storage and then sends them back to the client.
  2. Instead of sending the files via the REST call, I could send the download URL (from Cloud Storage) to the client. This would be more cost efficient, however this sounds like a security concern to me as anyone who simply monitors his network could capture the URL.
  3. Creating a (time-limited) signed url to allow the user the download

Obviously a permission check would have to happen first, e.g. a database that contains if user X purchased mp3 Y.

This problem could also be applied to Azure Blob Storage or AWS S3...

azure-blob-storage google-cloud-storage amazon-s3
1 Answers

In your use case, you have a constant:

  • You need a backend to authenticate the user (for example Authentication performed with Cloud Identity Platform and hosted on App Engine or Cloud Run
  • You need to check the list of MP3 that it has bought (stored in Firestore for example)
  • And then, you need to allow him to download the file. On this last point I recommend you to generated a signedURL. Download URL exists only in Firebase area (maybe your project is a firebase projet?) but it's the same thing than signerURL. Finally I don't recommend you the #1 proposal. It will work, but in case of long download (because network is poor), the connexion will be interrupted after 60 seconds. And this will keep your AppEngine up for nothing (and you will pay for this...).
user_113725930
Related