4 ms·
Isn't that a bit much to be throwing onto the shoulders of the application developer? At the very least I'd expect it to be explicitly documented that the poss
by dfranke 17y ago
Isn't that a bit much to be throwing onto the shoulders of the application developer? At the very least I'd expect it to be explicitly documented that the possibility of replays by untrusted parties needs to be considered. I know you took it into account, but I doubt you have very much company.
- cperciva 17y agoAt the very least I'd expect it to be explicitly documented that the possibility of replays by untrusted parties needs to be considered. Hmm, good point. The AWS documentation has never been very explicit about these sorts of issues -- I'll email a few people at Amazon and suggest that they improve this.
- NateLawson 17y agoYes, this is moving toward what I was trying to say. Sorry if that wasn't clear. But I think the answer is not more documentation but handling this for the developer at a lower layer. And instead of Amazon implementing this lower layer themselves, use existing protocols like SSL. With the exception of identity, SSL provides all the integrity protection, ordering, uniqueness, and even privacy that a developer could want. If you're willing to use client certs or SRP or basic auth, then you have identity covered too. Amazon is exactly right in recommending SSL primarily. I just think they should stop there and not add "but if you have SSL performance problems, use AWS-Auth".