Search Unity

  1. Welcome to the Unity Forums! Please take the time to read our Code of Conduct to familiarize yourself with the forum rules and how to post constructively.
  2. We’re making changes to the Unity Runtime Fee pricing policy that we announced on September 12th. Access our latest thread for more information!
    Dismiss Notice
  3. Unite 2023 Registrations are now LIVE! We are thrilled to announce that Unite 2023 Registration is now live and open for all!
    Dismiss Notice
New Forum User Notice Important updates to the Unity Runtime Fee policy Unite 2023 Registrations are now LIVE!

Protected client API and security

Discussion in 'Unity Cloud Content Delivery' started by hadrien23, Oct 28, 2020.

  1. hadrien23

    hadrien23

    Joined:
    Oct 9, 2019
    Posts:
    12
    Hi,
    What is the status regarding a protected client API, and is there any risks at the moment that a third party could access a bucket content using the public client API, or any other way?
    Regards.
     
    hadrien23, Oct 28, 2020
    #1

  2. timtunity3d

    timtunity3d

    Unity Technologies

    Joined:
    Oct 1, 2015
    Posts:
    123
    At the moment all content is public. We are still gathering requirements around protected content. If you have specific requirements we'd love to hear them and I can pass them along to our product managers.
     
    timtunity3d, Oct 28, 2020
    #2

  3. ChristinaGuo

    ChristinaGuo

    Unity Technologies

    Joined:
    Feb 20, 2020
    Posts:
    48
    Hi @hadrien_n , I'm the product manager for CCD. We've finally gotten around to private content. We're brainstorming a few solutions and would love to get your thoughts:
    • Option 1 would be to provide bucket level access keys. Only users with the access keys would be able to retrieve content from CCD. We imagine this to be similar to how Github allows users to generate keys.
    • Option 2 would be to support an IP whitelist per bucket (screenshots below). Only IPs on the list would be able to access content from CCD. We imagine this solution would be in addition to Option 1.
    Would either of these solutions work for your needs? Is the bucket level the right level for security?

    image.png image (1).png image (2).png
     
    ChristinaGuo, Jul 23, 2021
    #3

  4. CineTek

    CineTek

    Joined:
    Jul 12, 2013
    Posts:
    98
    To jump into this conversation - we are using an account system (Playfab) for all players including internal developers. At the moment our login screen is the only "protection" from excessive or unauthorized access. For us it would be ideal to have a security layer before CCD that allowed e.g. Playab and other account systems to send an auth token to CCD first.
    Because the login screen is not enough, once a player has access to the CCD bucket links they can easily DDOS the whole system - or at the very least, create huge traffic.
     
    CineTek, Aug 18, 2021
    #4

  5. ChristinaGuo

    ChristinaGuo

    Unity Technologies

    Joined:
    Feb 20, 2020
    Posts:
    48
    Hi @CineTek, we're implementing bucket level access keys. It seems that this would fit your use case. You can generate an access token that protects a private bucket. You can easily re-generate and update your clients if it gets compromises.

    The only issue I can see is if you wanted to create an access token per user, which may not play well with our caching.

    Do you have a sense for how many access tokens you might need to generate?
     
    ChristinaGuo, Aug 18, 2021
    #5

  6. CineTek

    CineTek

    Joined:
    Jul 12, 2013
    Posts:
    98
    Well, connected to the account system a per-user token that is changing dynamically would be the "ideal" solution.
    My concern with your approach is that the access token is still visible inside the game client and/or can be intercepted from local network which does not stop a maliciuous party from attacking the network? Unless the key cannot be intercepted
     
    CineTek, Aug 18, 2021
    #6

  7. CineTek

    CineTek

    Joined:
    Jul 12, 2013
    Posts:
    98
    I guess, what we could do internally is figure out if we can forward/push traffic through an internal proxy which uses the playfab auth as a security step - therefore hiding the official CCD servers... .
     
    CineTek, Aug 18, 2021
    #7

  8. ChristinaGuo

    ChristinaGuo

    Unity Technologies

    Joined:
    Feb 20, 2020
    Posts:
    48
    Hi @CineTek, in case you missed the announcement on the main forum, we've launched Private Buckets! Private buckets protect read access to buckets with an access token, so that only those users with that access token can retrieve content from that bucket. Let us know if you have any feedback!
     
    ChristinaGuo, Sep 22, 2021
    #8

  9. hadrien23

    hadrien23

    Joined:
    Oct 9, 2019
    Posts:
    12
    @ChristinaGuo Login in after a while, sorry I missed your first question. Awesome news about the new private buckets, thanks for the update!
     
    hadrien23, Oct 19, 2021
    #9
    ChristinaGuo likes this.