How can I create secure download links in Sitelok with Amazon S3?

Article Number: 6 | Last Updated: Mon, Apr 9, 2012 at 2:02 AM

Sitelok can create secure download links on members pages that allow access to downloads on your site. These special links use the siteloklink() function and keep the location of your files secret and ensure that only logged in members have access. For large files such as videos we recommend using Amazon S3. Sitelok works efficiently and securely with S3 allowing access to files up to 5GB in size without using bandwidth and resources on your server.

Setting up an S3 account

1) Signup for an S3 account at http://aws.amazon.com/s3/. Make a note of the Access Key ID and Secret Access Key that they assign you as these are used in Sitelok to create the download path.

2) Once you are signed up you can login to the console at https://console.aws.amazon.com/s3/home

3) When logged in you will see the main screen as follows.

4) Create a bucket by clicking the Create Bucket button. The bucket name must be unique on S3 and should be lowercase characters only. In this example I have named the bucket vibralogixtest. You can select which S3 server to store the file on. Any will work fine.

5) Once your bucket is created double click it in the Bucket List to open it ready to upload a file.

6) Click Upload in the Objects and Folders section of the screen and select the file to upload.

7) Once uploaded we need to check that the correct content type is being used. Right click the file and select Properties and then click the Metadata tag. You will see the default content type assigned by S3 to the file. This is usually fine for viewing the file (such as a .jpg or .pdf) in the browser if this is what you need. However often you will usually want the user to download the file instead in which case perform steps 8) to 10) below.

8) To force a file to be downloaded rather than displayed in the browser we need to change the default Content-Type to be

application/force-download

by entering that in the value field.

9) Now we will add a new header which is also required by some browsers to force a download. Click Add more metadata and enter the following

Key: Content-Disposition

Value: attachment;filename="filename.zip"

replacing the filename in the quotes with your filename.

The settings should look something like this when you are finished

10) Finally click Save to assigned the new file headers.

File Privacy

Sitelok accesses files from S3 using special signed links which can't be shared. Normally you should keep your files and buckets private to stop anyone accessing them without Sitelok using a standard S3 link. This is the default permission setting in the S3 Console anyway. You can set a buckets or files to have public access as well if you wish but we don't recommend this for obvious reasons. Please note that the S3 link displayed for a file in the console will fail unless you set public access but Sitelok links will still work.

S3 file path

The file path used by Sitelok is not the link that S3 provides you in the console as this is not secure and won't work with private buckets. Instead we create a one off specially signed link. So instead of the usual download path use a path setup like this

s3|accesskeyid|secretaccesskey|bucketname|

Replace the parts in green with your S3 account details and bucket name.

In Sitelok configuration you can make a download location for S3 and name it has required (S3 for example) like this