How to protect s3 files from downloading using downloadhelper plugin - node.js

Question

I have my video files stored in s3 bucket.
My files are downloadable using a plugin called Video DownloadHelper. It has two option download Using Browser and download Using Companion App.
I'm restricting S3 files access by setting bucket policy with specific http referrer.
After adding this policy now it is not possible to download Using Browser but able to download Using Companion App.
How can I restrict downloading files using the second method as well? The bucket policy I have set is given below. Any help would be appreciated. Thanks.
{
"Version": "2012-10-17",
"Id": "http referer policy example",
"Statement": [
{
"Sid": "Allow get requests referred by www.example.com and example.com.",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::examplebucket/*",
"Condition": {
"StringLike": {"aws:Referer": ["http://www.example.com/*","http://example.com/*"]}
}
},
{
"Sid": "Explicit deny to ensure requests are allowed only from specific referer.",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::examplebucket/*",
"Condition": {
"StringNotLike": {"aws:Referer": ["http://www.example.com/*","http://example.com/*"]}
}
}
]
}

Answer 1

Once your file is loaded in the browser, It can be downloaded. what you can do is to generate a signed URL for the images, which is valid for a short time.
set the src for the images to an API which redirects to a signed URL generated by the backend, so while inspecting the browser it will show the signed URL as SRC but that URL can't be reused. But this will only prevent the reuse of the image URLs or if the download-helper is using the URL to download the image. Here whenever the user refreshes the page a new URL will be generated and send to browser.
Eg:
<img src=https://api-url/image/image-id>
and in your backend do something similar to
response.redirect(signed-url)