Return AWS signature over HTTP

Question

I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.

My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for each) and eventually, finalises the file (a POST).

That works well. As you can guess, each request to S3 (hand-shake, part uploads and finalisation) has to be signed. It is of course out of the question to generate the signature in JS as it would expose my AWS secret key.

What I am doing so far is the following : before each request to S3, I send a request to my own back-end (to /sign?method=HTTPMethod&path=URLToSign) returns the signature string. This way, all AWS credentials stay in the back-end, as should be.

My question is the following : Is this secure?

I realise the /sign end-point could be used by anyone to sign anything into my S3 bucket. I can reduce risks by making sure the /sign request is an XHR whose referrer is my own domain.

Answer 1

Yeah the backend can be used in your case to sign anything into your s3 bucket.

You could block cross site XMlhttprequest for /sign but why you are letting others know that you are using some backend script. For this thing you might have to be aware of XSRF called as cross site request forgery attack that can be performed.

Specifically saying this method is not so much secure as compare to using backend to send data to aws. Also there are many ways that have been online to do cross site xhr request.

For prevention of xsrf you might have to look here too

http://www.codinghorror.com/blog/2008/10/preventing-csrf-and-xsrf-attacks.html http://www.cgisecurity.com/csrf-faq.html

But i wont do your way.though its easy and good way but it has vulnerability that can be exploited.