Hacker News Reader

The Amazon S3 support seems to suggest that the authors believe it is acceptable to store your AWS key ID and "secret" key in your client-side JavaScript code. Am I missing something here?

View on HN

What you're missing is that the secret isn't present. What's there is a policy, which is a way to preauthorize file uploads to S3. The policy is signed with the secret key ahead of time. It looks to me like all the fields in that form are safe to be exposed publicly.

See http://aws.amazon.com/articles/Java/1434.

Addendum: The "key" there means key in the S3 sense, as in the name of the object being stored.

Yes you are absolutely correct. http://imperavi.com/redactor/examples/s3/

The AWS secret is nowhere in that code. Just the ID, which is not privileged.

Reply on news.ycombinator.com