title: Direct file upload to S3 using sigv4
body: <p>I'm looking for a secure way to directly upload large files to S3 (for performance issue).</p>
  
  <p>After few hours of research, I've come to the (maybe incorrect) conclusion that I should use "Browser-Based Uploads Using POST".
  As referenced in this thread:
  <a href="https://stackoverflow.com/questions/17585881/amazon-s3-direct-file-upload-from-client-browser-private-key-disclosure">Amazon S3 direct file upload from client browser - private key disclosure</a></p>
  
  <p>Before trying this directly, I thought about making a cURL POC with direct upload and signature computation.
  I've failed to make it work, and <strong>haven't found a successful POC on the web using Authentification Version 4 manual settings.</strong></p>
  
  <p>My signature is OK. 
  The only issue is that Amazon is double SHA256ing my file content and is thus not validation my x-amz-content-sha-256 header.</p>
  
  <ul>
  <li>lower(SHA256(e8379a31b13fb9423928fe28dd41a5e3204a52072634503c31e8b3ea42605b46))
  = 4fa84cd7d18e0d33dbd62d0492eca4a159e122391ae0a3e636bd3cf527680c87</li>
  </ul>
  
  <p><strong>I'm not sure of understanding what should I put in my cURL and canonical request payload (and the linked content-length value) and the x-amz-content-sha-256 header.
  Should it all be the same values ?</strong>
  If yes, then the Amazon doc specifies it should all be encrypted to SHA256, so I've no idea why Amazon reSHA256 my already SHA256 payload...</p>
  
  <p>Error:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;
  &lt;Code&gt;XAmzContentSHA256Mismatch&lt;/Code&gt;
  &lt;Message&gt;The provided 'x-amz-content-sha256' header does not match what was computed.&lt;/Message&gt;&lt;ClientComputedContentSHA256&gt;e8379a31b13fb9423928fe28dd41a5e3204a52072634503c31e8b3ea42605b46&lt;/ClientComputedContentSHA256&gt;&lt;S3ComputedContentSHA256&gt;4fa84cd7d18e0d33dbd62d0492eca4a159e122391ae0a3e636bd3cf527680c87&lt;/S3ComputedContentSHA256&gt;
  &lt;RequestId&gt;419A185269B0F891&lt;/RequestId&gt;&lt;HostId&gt;QHWxK0Mzz6AfG44ypXBti3W0tYx1xkG9lZGqc2kUKyMF9STwP18M3racio0k06aH5+1ok/Irdn8=&lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>cURL command:</p>
  
  <pre><code>curl 
  -v https://??.s3.amazonaws.com/recordtest/test.jpg        
  -H "Authorization: AWS4-HMAC-SHA256 Credential=??/20170228/eu-west-1/s3/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date, Signature=43750caa762314eb70aace1f7f8ae34633b93352aa25646433ef21e48dd79429"        -H "Content-Length: 64"        
  -H "Content-Type: application/octet-stream"        
  -H "x-amz-content-sha256: e8379a31b13fb9423928fe28dd41a5e3204a52072634503c31e8b3ea42605b46"        
  -H "x-amz-date: 20170228T111828Z"        
  -d "e8379a31b13fb9423928fe28dd41a5e3204a52072634503c31e8b3ea42605b46"        
  -X PUT
  </code></pre>
  
  <p>Generated canonical request:</p>
  
  <pre><code>PUT
  /recordtest/test.jpg
  
  content-length:64
  content-type:application/octet-stream
  host:??.s3.amazonaws.com
  x-amz-content-sha256:e8379a31b13fb9423928fe28dd41a5e3204a52072634503c31e8b3ea42605b46
  x-amz-date:20170228T111200Z
  
  content-length;content-type;host;x-amz-content-sha256;x-amz-date
  e8379a31b13fb9423928fe28dd41a5e3204a52072634503c31e8b3ea42605b46
  </code></pre>
  
  <hr>