Pure Javascript app + Amazon S3 ?

Question

I'm looking to confirm or refute the following:

For what I have read so far it is not possible to write a web application with only javascript -- no server side logic -- served from Amazon S3 that also store data only to S3 if you need to have multiple clients with private data per client.

The issue I see is the Authorization header required for every Ajax call that would force me to put the signature (and my AWS id) right there in the page source for everybody to see.

Is that correct or I misunderstood the docs?

Are there workarounds?

Answer 1

In short, you are correct.

If your AWS key ends-up in any way on the client-side, you are in trouble.

---

A possible solution is, of course, to have the user specify their AWS key for storing their data.

Answer 2

iBeans offers a way around this without having to write any server side code. There's an S3 iBean (a developer is working on it to be released in the next few days - watch the mulesoft blog for an announcement) and you can access it right from your javascript. The iBean itself runs on a server so you wouldn't need to store your keys in the javascript.