Re:One second per second is harder than it sounds
by throw_away on Tuesday July 22, 2014 @12:55AM
(#8067453)
If ultrashort expiry time really mattered to you and ntpd not reliably working, you could always make a request of S3 and use the response's version of the date (which presumably is the version of time that really matters, as far as S3 is concerned).
I need to have an accurate clock to within a few seconds when I sign Amazon S3 files. I have code that gives access to restricted files on S3. To give access, the customer makes a request from my server, I authenticate, sign a new URL and redirect them to the signed S3 URL.
For security reasons, the URL gets a signature that expires after a few seconds. The expiration date is based on X seconds from my servers clock. If my servers time differs from S3 server time then, according to S3, the link could be expired before it's even created.
In theory, a redirect takes a second or less to complete so you'd think an expiration that's 5 seconds in the future would be enough. The reality is, over time, the server clock can differ as much as 1 minute or so from S3's clock. So, I just set the expiration to be 120 seconds into the future and call it a day.