S3 - serve images using presigned urls instead of public access #4111

New Issue

OVERLORD · 2026-02-05T08:08:53+03:00

OVERLORD commented

2026-02-05 08:08:53 +03:00

Originally created by @e-g1gor on GitHub (Sep 3, 2023).

Describe the feature you'd like

Currently, images saved to s3 with public access. More secure approach would be:

Users create separate S3 access key with read-only capabilities - see Limiting presigned URL capabilities
Use existing auth for images to generate temporary presigned urls - related MR https://github.com/BookStackApp/BookStack/pull/665
Use S3 urls at frontend for static images

Describe the benefits this would bring to existing BookStack users

Storing static files in S3 storage is defacto standart nowdays, there has to be way to do it securely

Can the goal of this request already be achieved via other means?

Maybe for now, it's easier to use some kind of s3 fuse mount + local_secure storage

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundemental request

How long have you been using BookStack?

Not using yet, just scoping

Additional context

Related to: https://github.com/BookStackApp/BookStack/issues/551 https://github.com/BookStackApp/BookStack/issues/763

Originally created by @e-g1gor on GitHub (Sep 3, 2023). ### Describe the feature you'd like Currently, images saved to s3 with public access. More secure approach would be: 1. Users create separate S3 access key with read-only capabilities - see [Limiting presigned URL capabilities](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html#PresignedUrlUploadObject-LimitCapabilities) 2. Use existing auth for images to generate temporary presigned urls - related MR https://github.com/BookStackApp/BookStack/pull/665 3. Use S3 urls at frontend for static images ### Describe the benefits this would bring to existing BookStack users Storing static files in S3 storage is defacto standart nowdays, there has to be way to do it securely ### Can the goal of this request already be achieved via other means? Maybe for now, it's easier to use some kind of s3 fuse mount + local_secure storage ### Have you searched for an existing open/closed issue? - [X] I have searched for existing issues and none cover my fundemental request ### How long have you been using BookStack? Not using yet, just scoping ### Additional context Related to: https://github.com/BookStackApp/BookStack/issues/551 https://github.com/BookStackApp/BookStack/issues/763

OVERLORD added the 🔨 Feature Request :cat2:🐈 Possible duplicate labels 2026-02-05 08:08:53 +03:00

OVERLORD closed this issue

2026-02-05 08:08:57 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#4111