Applicable scenarios
In standard client/server system architecture, the server is used for receiving and processing requests from the client. If OSS is used as a backend storage service, the client sends objects to the application server to upload, then forward, the objects to the OSS. In this process, the data need to be transmitted twice. Regarding high access volume scenarios, the server requires high bandwidth resources to satisfy multiple clients’ simultaneous upload needs, challenging the architecture’s scalability.
To resolve this issue, OSS provides an authorized third-party upload function. This means each client can directly upload files to the OSS, bypassing the need for a server. This reduces the cost for application servers and takes full advantage of the OSS’s ability to process massive data volumes.
Currently, there are two methods in which to grant upload permissions: URL signature and STS.
URL signature
The URL signature method adds an OSS AccessKeyID and Signature fields to the request URL, allowing users to directly use this URL for an upload. Each URL signature has an expiration time to ensure security. For details, refer to Add a signature to the URL.
Temporary access credentials
Temporary access credentials are granted through the Alibaba Cloud Security Token Service and provide users with access authorization.
For information on the implementation of temporary access credentials, refer to STS Java SDK.