S3 presigned URLs not working with Safari 15/iOS 15


We are migrating a project to PHP SDK V3 from V2. During the testing, we found the images using presigned URLs generated by PHP SDK V3 cannot successfully work with Safari 15/iOS 15. It is easy to test this problem by constructing a simple html file like this: <img src="presigned S3 URL">

Then open the html file in Safari, the image will not be successfully downloaded (403 error) unless you turn off the "Hide IP address" option in Safari 15's preference settings. In Safari 15/iOS 15, the "Hide IP address" is turned on by default, so it's not an option to ask end-users to turn it off. Nevertheless, if you generate the presigned S3 URL by PHP SDK v2, the presigned URLs will work well in Safari 15. We think the V4 signature algorithm used in PHP SDK v3 includes more header checking which failed in Safari 15. Please help us to solve this problem. Thanks a lot.

asked 3 months ago16 views
1 Answer
Accepted Answer

We found the problem. It is due to that Safari will use apple's machine to download the image file when the "Hide IP address" option is turned on. That machine's IP address is not in the allowed range of the IAM group user which generate the presigned url. Although we are still not sure why v2 signature used by PHP SDK v2 is OK on this situation.

answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions