I have a Django app that will invoke an API call (a Python function) to create a folder with a private S3 bucket. To invoke the function, a user will have to be logged in first.
The S3 bucket will look like this:
s3://somebucket/user1
s3://somebucket/user2
and so on
API call: https://somedomain.com/createfolder/user1
I don't want to allow user2 to call the API by substituting the user1 string with his username.
Assuming I can secure this API call, my Python function will then just go ahead and create a folder with the username given to it.
user1 will also have the ability to download only his/her files.
users can log in to my app via OAuth2 or username/password.
The questions: a. How do I secure my API so that user2 cannot commit actions on user1? b. Similarly, how do I create pre-signed URLs pointing to user1's file (a specific file, which could be a zipped form of a folder?
My research: I have heard of JWT and pre-signed URLs, but I'm having difficulties in understanding how to practically implement them in Django.