- Presigned URLs are intentionally designed replay attacks, turning a security weakness into a useful feature.
- SigV4 uses time-based signatures to prevent replay attacks; signatures expire after about 15 minutes.
- Presigned URLs embed the signature into URL parameters, allowing any HTTP client to access objects temporarily.
- They act as capability grants, limited to a specific method, path, and headers, and cannot be individually revoked except by invalidating the signing key.
- Expiry ranges from 1 second to 1 week, with no limit on the number of uses.
- URLs can leak but are time-limited, making them useful for preventing hotlinking.
- Overall, presigned URLs leverage the clock as a nonce to create stateless, secure temporary access.