4 ms·
OP here. There are a few reasons you might want uploads to go through the server, and they basically amount to having more control. Imagine that you have an AP
by mengledowl 9y ago
OP here.
There are a few reasons you might want uploads to go through the server, and they basically amount to having more control. Imagine that you have an API that's being used by multiple sources - maybe a web app and a mobile app. The initial work to create uploads to S3 directly for each might not be too bad, but what happens if you want to change something later? Maybe you decide to move from S3 to something else, or maybe you decide that each upload should actually generate 3 different sizes of the image. If you do it through the server, this is all relatively simple. On the other hand, if you do it directly to S3, then not only do you have to change it in two places now, but you also have to navigate the issue of app versions - your original app version is uploading to S3 but your new one is uploading to some other hosting service, so how do you really get off of S3? And how do you keep them in sync? Definitely possible, but much more painful than changing a few configuration options on the server and migrating the existing data, etc.
- hartator 9y agoI think you are mistaken. Currently best way to handle images for user is to upload directly to S3 via JS -> Save the S3 id to db -> Resize on the fly via aws lambda.
- andreime 9y agoNot an expert on this. This doesn't seem secure. How are you confident you don't allow people to misuse your s3 bucket?
- aaronds 9y agoThe S3 SDK allows you to generate a URL that can only be used to upload to a specific path (+ there are other constraints you can enforce, file size / mime type etc)
- eknkc 9y agoYou create a policy [1] for each upload and sign it. The users browser has to provide the policy which can set the path (or prefix), limit file size etc. [1]: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-HTTPPOSTConstructPolicy.html http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-HTTPPOS...
- andreime 9y agoThanks! TIL and I will actually need this info next month :)
- mengledowl 9y ago"Best" is relatively subjective here, I think. Some people may agree that your approach is "best", but plenty of people would also prefer to keep as much of their logic in one place as possible.