Website runs all in S3, no server.

http://blog.tomevslin.com/2008/03/amazon-s3-backs.html

by jfno67 • 18 years ago

61 12 18 years ago

blog.tomevslin.com

inklesspen2• 18 years ago

When I'm reading about how he does this, it looks like it has all the app logic in client-side Javascript. That scares me from a security standpoint.

run4yourlives• 18 years ago

First thing I thought of as well.

bprater• 18 years ago

IF everything is stored somewhere on the client (including keys), what prevents someone malicious from borrowing the same keys to wreck havoc on your S3 bucket?

aschobel2• 18 years ago

The secret key isn't stored in the client (I looked :P), only the AWSAccessKeyId, policy, and signature are.

The policy dictates what can be stored in the bucket, and the signature validates the policy so folks don't tamper with it.

lvecsey• 18 years ago

The other key concept is that after some clients upload to a specific sub path area that is authorized for uploads, the clients can use a query string option on a GET request to list out files in that area. I suppose the website owner could have one or more administrative javascript sessions running that will periodically poll this area as just described, to process the data and upload a more compact listing for clients to retrieve.

sabat• 18 years ago

If it's read-only, no harm. Add write abilities and he's in deep trouble. But from what I gathered (he seems to be using only GET except for admin), the site is read-only.

inklesspen2• 18 years ago

How's it handle user submissions, then?

Here's the site in question: http://s3.amazonaws.com/broadbandwiki/broadbandwiki.html

rapind• 18 years ago

The consumer facing side requires no access keys so he's good. The admin side does however, so the assumption is that only a select few (one person really) is responsible for administration.

You could add SimpleDB to the mix to store hash data using similar practices.

Pretty cool imho. Libraries like jquery can easily be used to create the C in MVC anyways. Model in SimpleDB, C in Jquery, and V (plus any bin files) in S3.

aschobel2• 18 years ago

There is some validation logic on the server side using an S3 policy.

Base64 decode the policy input field on the postForm and you get:

  {
  "expiration": "2009-01-01T12:00:00.000Z",
  "conditions": [
    {"bucket": "vtabroadbandwiki" },
    {"acl": "private" },
    ["starts-with", "$key", ""],
    ["starts-with", "$Content-Type", "text/xml"],
  ]
  }

http://doc.s3.amazonaws.com/proposals/post.html#Access_Contr...

lux• 18 years ago

It would be interesting to combine this with Google Gears for offline storage too. Tougher to create something that securely shared data between users, but for a single user this could still make some powerful apps!

vlad• 18 years ago

Static IP's are a game-changing game changer.

tlrobinson• 18 years ago

This is a neat trick, but not very flexible or scalable.

Basically each user is given a presigned authorization token that lets them upload certain files to their bucket. Other users only have read access to the index. The clever trick is that the key is used to store the publicly available data like the latitude and longitude.

It works out well in his case, but it's not very useful generally.

Website runs all in S3, no server.

Related Stories