title: Secure browser-based S3 uploads: signed policy doc or presigned URL?
body: <p>I want to allow users to upload files directly from their browser to an S3 bucket. I've seen some recommendations for signing policy documents on the server, and others that suggest creating a pre-signed URL on the server and passing it back to the client. </p>
  
  <p>For example, this Django REST Framework library provides options for both:
  <a href="https://github.com/bodylabs/drf-to-s3" rel="nofollow noreferrer">https://github.com/bodylabs/drf-to-s3</a></p>
  
  <p>What are the advantages/disadvantages from a security perspective?</p>