{"action":"created","issue":{"url":"https://api.github.com/repos/FineUploader/fine-uploader/issues/1406","repository_url":"https://api.github.com/repos/FineUploader/fine-uploader","labels_url":"https://api.github.com/repos/FineUploader/fine-uploader/issues/1406/labels{/name}","comments_url":"https://api.github.com/repos/FineUploader/fine-uploader/issues/1406/comments","events_url":"https://api.github.com/repos/FineUploader/fine-uploader/issues/1406/events","html_url":"https://github.com/FineUploader/fine-uploader/issues/1406","id":73344991,"number":1406,"title":"It's not possible to supply sessionToken if request is being signed by backend","user":{"login":"eugenebond","id":1640934,"avatar_url":"https://avatars.githubusercontent.com/u/1640934?v=3","gravatar_id":"","url":"https://api.github.com/users/eugenebond","html_url":"https://github.com/eugenebond","followers_url":"https://api.github.com/users/eugenebond/followers","following_url":"https://api.github.com/users/eugenebond/following{/other_user}","gists_url":"https://api.github.com/users/eugenebond/gists{/gist_id}","starred_url":"https://api.github.com/users/eugenebond/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eugenebond/subscriptions","organizations_url":"https://api.github.com/users/eugenebond/orgs","repos_url":"https://api.github.com/users/eugenebond/repos","events_url":"https://api.github.com/users/eugenebond/events{/privacy}","received_events_url":"https://api.github.com/users/eugenebond/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-05-05T15:25:10Z","updated_at":"2016-04-10T05:21:20Z","closed_at":null,"body":"Hi,\r\n\r\nI have the following configuration\r\n```\r\n  <script type=\"text/javascript\">\r\n    $(function() {\r\n      $('#fineUploader').fineUploaderS3({\r\n          template: 'qq-template',\r\n          request: {\r\n              endpoint: \"https://MY-BUCKET-HERE.s3.amazonaws.com\",\r\n          },\r\n          credentials: {\r\n              accessKey: \"...\",\r\n              sessionToken: \"...\",\r\n              expiration: \"2015-05-06\",\r\n          },\r\n          signature: {\r\n              endpoint: \"/my_end_point\"\r\n          },\r\n          uploadSuccess: {\r\n              endpoint: \"index.html\"\r\n          },\r\n          chunking: {\r\n              enabled:   true,\r\n              mandatory: true,\r\n          }\r\n      });\r\n    });\r\n  </script>\r\n```\r\n\r\nThe headers that end up being POST-ed to the backend are the following\r\n```\r\nPOST\r\n\r\nimage/gif\r\n\r\nx-amz-acl:private\r\nx-amz-date:Tue, 05 May 2015 15:11:11 GMT\r\nx-amz-meta-qqfilename:600-animated.gif\r\n/MY-BUCKET-HERE/9c061d9f-c743-4831-93cd-d4fd7cc72896.gif?uploads\r\n```\r\n\r\nSince `x-amz-security-token` is missing here, this never gets authenticated by Amazon. I tried plugging `sessionToken` in different places, e.g. into `request` but never managed to get it to work.\r\n\r\nAlso on a side note, for the example above, the header that gets sent to Amazon is \r\n`Authorization:AWS null:signture-goes-here`. So it appears that `credentials.accessKey` does not get picked up because it considers `credentials` set to be incomplete without `secretKey` in it (which I don't want to put there, I want the request to be signed by backend). I am not sure if it's a bug or intended behavior. \r\n\r\nI managed to get all of this working in one of two ways:\r\n- by supplying all 4 values into `credentials`\r\n- by having `request.accessKey` set and hacking JS code to set `x-amz-security-token` like this `headers[\"x-amz-security-token\"] = 'a string with my token'`\r\n\r\n\r\nVersion: 5.2.1"},"comment":{"url":"https://api.github.com/repos/FineUploader/fine-uploader/issues/comments/207921412","html_url":"https://github.com/FineUploader/fine-uploader/issues/1406#issuecomment-207921412","issue_url":"https://api.github.com/repos/FineUploader/fine-uploader/issues/1406","id":207921412,"user":{"login":"feltnerm","id":146949,"avatar_url":"https://avatars.githubusercontent.com/u/146949?v=3","gravatar_id":"","url":"https://api.github.com/users/feltnerm","html_url":"https://github.com/feltnerm","followers_url":"https://api.github.com/users/feltnerm/followers","following_url":"https://api.github.com/users/feltnerm/following{/other_user}","gists_url":"https://api.github.com/users/feltnerm/gists{/gist_id}","starred_url":"https://api.github.com/users/feltnerm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feltnerm/subscriptions","organizations_url":"https://api.github.com/users/feltnerm/orgs","repos_url":"https://api.github.com/users/feltnerm/repos","events_url":"https://api.github.com/users/feltnerm/events{/privacy}","received_events_url":"https://api.github.com/users/feltnerm/received_events","type":"User","site_admin":false},"created_at":"2016-04-10T05:21:20Z","updated_at":"2016-04-10T05:21:20Z","body":"Since the secret key and access key should change in tandem would it make sense to have the signature endpoint return the accessKey? This would ensure each request was signed using the right secret-/access-key pair (I think)."}}