4 ms·
IF everything is stored somewhere on the client (including keys), what prevents someone malicious from borrowing the same keys to wreck havoc on your S3 bucket?
by bprater 19y ago
IF everything is stored somewhere on the client (including keys), what prevents someone malicious from borrowing the same keys to wreck havoc on your S3 bucket?
- lvecsey 19y agoThe other key concept is that after some clients upload to a specific sub path area that is authorized for uploads, the clients can use a query string option on a GET request to list out files in that area. I suppose the website owner could have one or more administrative javascript sessions running that will periodically poll this area as just described, to process the data and upload a more compact listing for clients to retrieve.
- aschobel 19y agoThe secret key isn't stored in the client (I looked :P), only the AWSAccessKeyId, policy, and signature are. The policy dictates what can be stored in the bucket, and the signature validates the policy so folks don't tamper with it.