javascript - Amazon S3 direct file upload from client browser - private key disclosure -
i'm implementing direct file upload client machine amazon s3 via rest api using javascript, without server-side code. works fine 1 thing worrying me...
when send request amazon s3 rest api, need sign request , put signature authentication header. create signature, must use secret key. things happens on client side, so, secret key can revealed page source (even if obfuscate/encrypt sources).
how can handle this? , problem @ all? maybe can limit specific private key usage rest api calls specific cors origin , put , post methods or maybe link key s3 , specific bucket? may there authentication methods?
"serverless" solution ideal, can consider involving serverside processing, excluding uploading file server , send in s3.
i think want browser-based uploads using post.
basically, need server-side code, generate signed policies. once client-side code has signed policy, can upload using post directly s3 without data going through server.
here's official doc links:
diagram: http://docs.aws.amazon.com/amazons3/latest/dev/usinghttppost.html
example code: http://docs.aws.amazon.com/amazons3/latest/dev/httppostexamples.html
the signed policy go in html in form this:
<html> <head> ... <meta http-equiv="content-type" content="text/html; charset=utf-8" /> ... </head> <body> ... <form action="http://johnsmith.s3.amazonaws.com/" method="post" enctype="multipart/form-data"> key upload: <input type="input" name="key" value="user/eric/" /><br /> <input type="hidden" name="acl" value="public-read" /> <input type="hidden" name="success_action_redirect" value="http://johnsmith.s3.amazonaws.com/successful_upload.html" /> content-type: <input type="input" name="content-type" value="image/jpeg" /><br /> <input type="hidden" name="x-amz-meta-uuid" value="14365123651274" /> tags file: <input type="input" name="x-amz-meta-tag" value="" /><br /> <input type="hidden" name="awsaccesskeyid" value="akiaiosfodnn7example" /> <input type="hidden" name="policy" value="policy" /> <input type="hidden" name="signature" value="signature" /> file: <input type="file" name="file" /> <br /> <!-- elements after ignored --> <input type="submit" name="submit" value="upload amazon s3" /> </form> ... </html> notice form action sending file directly s3 - not via server.
every time 1 of users wants upload file, create policy , signature on server. return page user's browser. user can upload file directly s3 without going through server.
when sign policy, typically make policy expire after few minutes. forces users talk server before uploading. lets monitor , limit uploads if desire.
the data going or server signed urls. secret keys stay secret on server.
Comments
Post a Comment