Hacker News Reader

Not an expert on this.

This doesn't seem secure. How are you confident you don't allow people to misuse your s3 bucket?

You create a policy [1] for each upload and sign it. The users browser has to provide the policy which can set the path (or prefix), limit file size etc.

[1]: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-HTTPPOS...

Thanks! TIL and I will actually need this info next month :)

The S3 SDK allows you to generate a URL that can only be used to upload to a specific path (+ there are other constraints you can enforce, file size / mime type etc)

Reply on news.ycombinator.com