How secure is Signed URL with Apigee, if URL get leaked to third person

[Ashishkumar2]

I am looking to integrate an API with Apigee which will be uploading files to GCP Cloud storage. The solution I am leaning towards is using Signed URL. But I have a concern on what if, the Signed URL get leaked. Once the URL has been signed, anyone in possession of it will have access to the object, to either GET or PUT a file, depending on what you've specified in the signing process.

Even with the expiration time, the URL will be accessible by anyone who holds the URL.

Is there any way to prevent that?

[dchiesa1 · Accepted solution]

what if, the Signed URL get leaked. Once the URL has been signed, anyone in possession of it will have access to the object, to either GET or PUT a file, depending on what you've specified in the signing process.

A SignedURL is a secret. You do not want it to leak. The way to mitigate the risk is to reduce the validity time for the signedURL. you can make it valid for 10 seconds, or 3 minutes, etc, to radically shrink the window of vulnerability.  But the first line of defense is: don't let the URL leak !  Which means only use TLS for transmitting it. And then take steps in the receiving app to insure it is less likely to leak.  don't store it persistently. Don't share it around, etc.

[dchiesa1 · Accepted solution]

what if, the Signed URL get leaked. Once the URL has been signed, anyone in possession of it will have access to the object, to either GET or PUT a file, depending on what you've specified in the signing process.

A SignedURL is a secret. You do not want it to leak. The way to mitigate the risk is to reduce the validity time for the signedURL. you can make it valid for 10 seconds, or 3 minutes, etc, to radically shrink the window of vulnerability.  But the first line of defense is: don't let the URL leak !  Which means only use TLS for transmitting it. And then take steps in the receiving app to insure it is less likely to leak.  don't store it persistently. Don't share it around, etc.

[Ashishkumar2 · Accepted solution]

Can we create cert based Singed URL? If Yes, how?