I'm trying to implement the following scenario:

  1. Host downloadable product on AmazonS3
  2. Make S3 files private (not accessibile by direct url)
  3. Enable access if Referrer is mywebsite

If I try to point on a webpage to product url, referrer il trasferred and download start but if I try to buy a product and to use the url autogenerated by magento, I get "not authorized" error from Amazon S3.

I think that the problem is that Referrer header are not set, is there a way to add this to download link?

Edit 28/12: I tried to debug download url and I have the following result:

Request URL:***mydomain***/downloadable/download/link/id/MC41MTUzODgwMCAxNTEzNzYxNDk4MjEzMTg1NjU1Nw,,/
Request Method:GET
Status Code:302 
Remote Address:*****
Referrer Policy:no-referrer-when-downgrade

I think that the problem is Referrer Policy. How can I change it? I tried to edit Download.php class as following with no success

                $headers = 'GET ' . $path . $query . ' HTTP/1.0' . "\r\n"
                . 'Host: ' . $urlProp['host'] . "\r\n"
                . 'User-Agent: Magento ver/' . Mage::getVersion() . "\r\n"
                . 'Referrer-Policy: origin' . "\r\n"
                . 'Connection: close' . "\r\n"
                . "\r\n";
            fwrite($this->_handle, $headers);
  • I wonder why you get a Status Code of 302 for the URL above? Where does it redirect to? EDIT: Never mind, just had a look into the controller and you're redirected to /customer/products. Commented Jan 25, 2018 at 12:45
  • Which message do you get after redirect? An error occurred while getting the requested content? Requested link does not exist? Commented Jan 25, 2018 at 12:49
  • The error is like "permission denied", I'm not authorized to open that file
    – domfitty
    Commented Feb 1, 2018 at 4:16
  • Hey this extension has amazon s3 downloadable products related functionality if you want to take a look magecomp.com/magento-2-amazon-s3.html Commented Feb 29, 2020 at 7:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.