18 ms·
What's wrong with doing all of this on the front-end? I recently did just that after generating the signature and policy locally. See this guide: https://aws.a
by shakeel_mohamed 10y ago
What's wrong with doing all of this on the front-end? I recently did just that after generating the signature and policy locally.
See this guide: https://aws.amazon.com/articles/1434 https://aws.amazon.com/articles/1434
- CaveTech 10y agoYou leak your secret key to every user who can view that page.
- am17an 10y agoYeah, that's true. But you can limit the secret key to an IAM user with only perms to uploading to that particular bucket. I know it can still cause damage, but nothing like disclosing your root key. If you do a cost-analysis taking into account development on the back-end, doesn't seem so bad, till of course, it does.
- petethepig 10y agoNo you don't. You leak AWSAccessKeyId which is not a secret. You use a signature to authorize the file upload.
- CaveTech 10y agoI should've been more verbose. You cannot calculate the signature client side without leaking the key. So you need a server. That step is identical to what this "serverless" implementation is doing.
- shakeel_mohamed 10y agoCorrect. But the signature doesn't necessarily need to be per-file upload, so I have it embedded in JS. For my use case, saving the extra network hop is worthwhile.
- kuschku 10y agoSo I can extract it from the JS, and just upload terabytes?
- e12e 10y agoThe benefit of doing uploads on the front-end is that it's instant: the file is already there! ;-)