I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.
My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for each) and eventually, finalises the file (a POST).
That works well. As you can guess, each request to S3 (hand-shake, part uploads and finalisation) has to be signed. It is of course out of the question to generate the signature in JS as it would expose my AWS secret key.
What I am doing so far is the following : before each request to S3, I send a request to my own back-end (to
/sign?method=HTTPMethod&path=URLToSign) returns the signature string. This way, all AWS credentials stay in the back-end, as should be.
My question is the following : Is this secure?
I realise the
/sign end-point could be used by anyone to sign anything into my S3 bucket. I can reduce risks by making sure the
/sign request is an XHR whose referrer is my own domain.