4 ms·
No you don't. You leak AWSAccessKeyId which is not a secret. You use a signature to authorize the file upload.
by petethepig 10y ago
No you don't. You leak AWSAccessKeyId which is not a secret. You use a signature to authorize the file upload.
- CaveTech 10y agoI should've been more verbose. You cannot calculate the signature client side without leaking the key. So you need a server. That step is identical to what this "serverless" implementation is doing.
- shakeel_mohamed 10y agoCorrect. But the signature doesn't necessarily need to be per-file upload, so I have it embedded in JS. For my use case, saving the extra network hop is worthwhile.
- kuschku 10y agoSo I can extract it from the JS, and just upload terabytes?