Hacker News Reader

I think you are mistaken. Currently best way to handle images for user is to upload directly to S3 via JS -> Save the S3 id to db -> Resize on the fly via aws lambda.

View on HN

"Best" is relatively subjective here, I think. Some people may agree that your approach is "best", but plenty of people would also prefer to keep as much of their logic in one place as possible.

Not an expert on this.

This doesn't seem secure. How are you confident you don't allow people to misuse your s3 bucket?

The S3 SDK allows you to generate a URL that can only be used to upload to a specific path (+ there are other constraints you can enforce, file size / mime type etc)

You create a policy [1] for each upload and sign it. The users browser has to provide the policy which can set the path (or prefix), limit file size etc.

[1]: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-HTTPPOS...

Thanks! TIL and I will actually need this info next month :)

Reply on news.ycombinator.com