Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.

My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for each) and eventually, finalises the file (a POST).

That works well. As you can guess, each request to S3 (hand-shake, part uploads and finalisation) has to be signed. It is of course out of the question to generate the signature in JS as it would expose my AWS secret key.

What I am doing so far is the following : before each request to S3, I send a request to my own back-end (to /sign?method=HTTPMethod&path=URLToSign) returns the signature string. This way, all AWS credentials stay in the back-end, as should be.

My question is the following : Is this secure?

I realise the /sign end-point could be used by anyone to sign anything into my S3 bucket. I can reduce risks by making sure the /sign request is an XHR whose referrer is my own domain.

share|improve this question
    
I dont know enough about how secure this approach is, but in general I would never ever allow anything from clientside to access my S3 folders with update access. Call me paranoid, but I sleep much better knowing that that only serverside is communicating with my storage. –  BerggreenDK Mar 11 '13 at 11:18

1 Answer 1

Yeah the backend can be used in your case to sign anything into your s3 bucket.

You could block cross site XMlhttprequest for /sign but why you are letting others know that you are using some backend script. For this thing you might have to be aware of XSRF called as cross site request forgery attack that can be performed.

Specifically saying this method is not so much secure as compare to using backend to send data to aws. Also there are many ways that have been online to do cross site xhr request.

For prevention of xsrf you might have to look here too

http://www.codinghorror.com/blog/2008/10/preventing-csrf-and-xsrf-attacks.html http://www.cgisecurity.com/csrf-faq.html

But i wont do your way.though its easy and good way but it has vulnerability that can be exploited.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.