3 ms·
The Amazon S3 support seems to suggest that the authors believe it is acceptable to store your AWS key ID and "secret" key in your client-side JavaScript code.
by axefrog 14y ago
The Amazon S3 support seems to suggest that the authors believe it is acceptable to store your AWS key ID and "secret" key in your client-side JavaScript code. Am I missing something here?
- deveshz 14y agoYes you are absolutely correct. http://imperavi.com/redactor/examples/s3/ http://imperavi.com/redactor/examples/s3/
- ceejayoz 14y agoThe AWS secret is nowhere in that code. Just the ID, which is not privileged.
- smarx 14y agoWhat you're missing is that the secret isn't present. What's there is a policy, which is a way to preauthorize file uploads to S3. The policy is signed with the secret key ahead of time. It looks to me like all the fields in that form are safe to be exposed publicly. See http://aws.amazon.com/articles/Java/1434 http://aws.amazon.com/articles/Java/1434. Addendum: The "key" there means key in the S3 sense, as in the name of the object being stored.