Content delivery design

Question

I'm designing a system where users can access files stored in an external content storage service such as AWS's S3. Here's a simple diagram:

 ------       ------------       -----------------
| User | <=> | Web Server | <=> | Content Storage |
 ------       ------------       -----------------

The files are stored with a (long) unique ID. I'm concerned mainly about two things: performance and information security.

There are two options that come to mind but I'm sure it can be done in a better way (performance and security-wise):

1. Give the user a url with which the file can be downloaded directly from the content storage service. Cons: the URL could be brute forced. This could be solved putting a password to the file, but I'd like to use that as a last resort.
2. The web server downloads the file from content storage service and then serves it to the user. Cons: too much traffic.

Is there a way to make an HTTP redirect without exposing the file's resolved URL? Something like proxying packets?

I don't want to make this technology-specific (that's what SO is for), but just in case it adds any value, I'm using Rails a rails server behind nginx. I have full control over the web server, but I'm limited on the content storage service since I'm using S3.

Answer 1

The only way I see now is to use REST authentication provided by Amazon

It creates expiring URLs that can be given to third-party. So, basically the idea is to login user to your website, check his permissions and then generate URL for him to download file from.

AWS IAM also can be used for that, but that limits the number of options, actually.

Answer 2

Perhaps you already suggested this with "password to the file": combine option 1 (url to download directly) with encryption of the file, so that it can be securely decrypted by the client application only by clients with possession of a secret key. That is probably a minimum level of security anyway, if you are concerned about security at all. It won't help with denial of service attacks.