tag:blogger.com,1999:blog-6057799.post2433579401187869316..comments2023-03-26T18:47:47.424-05:00Comments on --Mike--: Capabilities, Internet Style - Part 1Mike Warothttp://www.blogger.com/profile/12975818268596648269noreply@blogger.comBlogger1125tag:blogger.com,1999:blog-6057799.post-4301552999780370922008-05-07T12:45:00.000-05:002008-05-07T12:45:00.000-05:00Have a look at the Query String Request Authentica...Have a look at the <A HREF="http://docs.amazonwebservices.com/AmazonS3/2006-03-01/RESTAuthentication.html#RESTAuthenticationQueryStringAuth" REL="nofollow">Query String Request Authentication Alternative</A> for S3 GET requests and <A HREF="http://docs.amazonwebservices.com/AmazonS3/2006-03-01/HTTPPOSTForms.html#HTTPPOSTConstructPolicy" REL="nofollow">Policy Construction</A> for browser-based POST uploads. Both techniques let an Amazon S3 developer delegate limited privileges to anyone with a browser. The person clicking the link or submitting the form need not have an AWS account. You might say that both S3 "signed" URLs and "signed" form POST elements act like capabilities in the S3 system.John Cormiehttps://www.blogger.com/profile/08624945931699192996noreply@blogger.com