如何使用基于浏览器的S3上传来验证文件的内容？

Question

I'm working on a project where all user image uploads are stored on S3. To save bandwidth and avoid the upload going through our servers, we're using HTML Form based uploads (see http://docs.amazonwebservices.com/AmazonS3/latest/dev/HTTPPOSTForms.html ).

What are the best practices for validating the contents of the upload to avoid non-image/malicious files sneaking onto and being served from my account? Is there a way to do this out of the box with S3? Or do I need to validate this on my server, after the file has been uploaded (which would pretty much defeat the purpose of going direct to s3 in the first place)?

Answer 1

If you use jquery file upload combined with the html5 s3 form you can use some code similar to below to handle the uploading proccess. Before the file is uploaded you can check the file type and also the size with file.size < 50000000 before the file hits the server.

jQuery ->   
   $('#fileupload').fileupload
     add: (e, data) ->
       types = /(\.|\/)(gif|jpe?g|png)$/i
       file = data.files[0]
       if types.test(file.type) || types.test(file.name)
         data.context = $(tmpl("template-upload", file))
         $('#fileupload').append(data.context)
         data.submit()
       else
         alert("#{file.name} is not a gif, jpeg, or png image file")