Presign urls included in template css files

Using Django Templates & Frontend
1

Hello everybody,

I’m using s3 and S3Boto3Storage to host and manage my static files, including django admin’s files:
#settings.py
STATIC_URL = “``https://my-static-files.s3.eu-west-1/static/``”
STORAGES = {
“staticfiles”: {
“BACKEND”: “storages.backends.s3boto3.S3Boto3Storage”,
},
}

The bucket is not publicly accessible, unless the requested urls are presigned. S3Boto3Storage does this automatically in the context of the template renderer, which is great. However, the urls that are included in the css files are not presigned:

This results in requests to those urls being rejected:

deined
deined1437×222 31.1 KB

How could I tackle this problem?

2

One dirty solution is to separate these css rules that require some processing from the django static tag to a template. Example:

# includes/dynamic_style_tag.html
<style>
  .viewlink .inlineviewlink {
    background: url({% static "admin/img/icon-viewlink.svg" %}) 0 1px no-repeat;
  }
  /* Other rules omitted for simplicity */
</style>

# templates/some_template.html
<html>
  <head>
    {% include "includes/dynamic_style_tag.html" %}
  </head>
</html>

With this approach, the URLs will pre-signed by django.

Another (also dirty IMO) approach would to turn the bucket public for external access, if it’s only serving static files that are “public”

3

Hi Leandro, thank you

If I understand your solution well, I’d be turning every css static file with included urls into templates? I’m ok with this but in that case is there a way to not do it manually but instead to have some kind of template processor, so it can be cross-django-versions safe? I’m not too familiar with that part of django, I’ll look into it.

The turning the public statics private is a new company policy. I could make my boss read that sentence and convince them this is stupid but I’d rather comply if possible.

4

I would never use presigned/private URLs for serving assets (like CSS) of public applications on the internet. I don’t get the use case :slight_smile:

5

I wouldn’t say every but some of them, that needs this processing yes.

I’m not saying that you should do the approaches that I’ve mentioned, rather that you can do them.

I also agree on this one:

In this case, I would try my best to explain to my boss that this decision doens’t make any sense, if you believe that some approach is not benefical and does nothing about it, then in the end you agreeing with the “madness” instead of fighting it.
In the end, you might get a direct order to do something in other way, but if you tried to do something against it, then at least you know that you’ve tried your best to do things on the way they should be.

6

Some of our static files are images that are company property and may only be displayed in certain contexts (django admin panel for instance). I placed them in another private storage and de-privated the public static storage. I think that covers the new requirements.