title: Amazon S3 direct file upload from client browser - private key disclosure
body: <p>I'm implementing a direct file upload from client machine to Amazon S3 via REST API using only JavaScript, without any server-side code. All works fine but one thing is worrying me...</p>
  
  <p>When I send a request to Amazon S3 REST API, I need to sign the request and put a signature into <code>Authentication</code> header. To create a signature, I must use my secret key. But all things happens on a client side, so, the secret key can be easily revealed from page source (even if I obfuscate/encrypt my sources).</p>
  
  <p>How can I handle this? And is it a problem at all? Maybe I can limit specific private key usage only to REST API calls from a specific CORS Origin and to only PUT and POST methods or  maybe link key to only S3 and specific bucket? May be there are another authentication methods?</p>
  
  <p>"Serverless" solution is ideal, but I can consider involving some serverside processing, excluding uploading a file to my server and then send in to S3.</p>