title: Django and AWS S3: Storing and securing private files
body: <p>I have a Django app that will invoke an API call (a Python function) to create a folder with a private S3 bucket. To invoke the function, a user will have to be logged in first.</p>
  <p>The S3 bucket will look like this:</p>
  <pre><code>s3://somebucket/user1
  s3://somebucket/user2
  and so on
  </code></pre>
  <p>API call: <code>https://somedomain.com/createfolder/user1</code></p>
  <p>I don't want to allow user2 to call the API by substituting the <code>user1</code> string with his username.</p>
  <p>Assuming I can secure this API call, my Python function will then just go ahead and create a folder with the username given to it.</p>
  <p>user1 will also have the ability to download only his/her files.</p>
  <p>users can log in to my app via OAuth2 or username/password.</p>
  <p>The questions:
  a. How do I secure my API so that user2 cannot commit actions on user1?
  b. Similarly, how do I create pre-signed URLs pointing to user1's file (a specific file, which could be a zipped form of a folder?</p>
  <p>My research: I have heard of JWT and pre-signed URLs, but I'm having difficulties in understanding how to practically implement them in Django.</p>