It isn't an intermediary: you get a signature from your server (no actual file data sent) and then you use S3's support for direct browser uploads to send the a

It isn't an intermediary: you get a signature from your server (no actual file data sent) and then you use S3's support for direct browser uploads to send the actual file data. One additional point to note: this has been possible since 2008 (see http://aws.amazon.com/articles/1434 http://aws.amazon.com/articles/1434) and strictly speaking doesn't need CORS. If you use a hidden FORM element that targets a hidden iframe you can do this without needing a browser that supports CORS: you do lose the upload progress information, however.