POST Policies in Tigris

Hi,

I'm trying to implement post policies to enforce a content‑length limit, but receive 405 responses when I upload to any URL I can imagine being correct (I'm using custom domains but have tried tigris.dev, with/out object key, etc). Is POST supported yet?

POST is supported. Have a look at the documentation at Browser-Based Uploads Using HTTP POST | Tigris Object Storage Documentation.

Thanks for the quick reply , I managed to miss that page. There was an issue with my URL after all.

I ran into another problem: using the Dart dio client to construct form data results in the error

The body of your POST request is not well-formed multipart/form-data

It isn’t clear what’s wrong since I’m following the library examples and the form parses fine in the browser. Below is the example source; any obvious issues?

! image

Hi,

We will look into this meanwhile, is it possible to provide us with a replay-able cURL request command?

Yah for sure, here’s curl for a policy example without a pre‑defined object key that fails in browser. It seems like the server is allowing partial to full upload before throwing an error.

curl -X POST \
  -H "Content-Type: multipart/form-data" \
  -F "bucket=public.fffs.absurd.chat" \
  -F "x-amz-date=20240428T203306Z" \
  -F "x-amz-algorithm=AWS4-HMAC-SHA256" \
  -F "x-amz-credential=tid_EuMhLzbqmFAYVsrckIzvKvOxZZkEmYSVberVGIakQqaFwAQHqW/20240428/auto/s3/aws4_request" \
  -F "policy=eyJjb25kaXRpb25zIjpbWyJlcSIsIiRidWNrZXQiLCJwdWJsaWMuZmZmcy5hYnN1cmQuY2hhdCJdLFsiY29udGVudC1sZW5ndGgtcmFuZ2UiLDAsMjA5NzE1MjAwXSxbImVxIiwiJHgtYW16LWRhdGUiLCIyMDI0MDQyOFQyMDMzMDZaIl0sWyJlcSIsIiR4LWFtei1hbGdvcml0aG0iLCJBV1M0LUhNQUMtU0hBMjU2Il0sWyJlcSIsIiR4LWFtei1jcmVkZW50aWFsIiwidGlkX0V1TWhMozJqbGZBWVZzcmNrSXp2S3ZPeFpaa0VtWVNWYmVyVkdJYWtRcWFGd0FRSHFXLzIwMjQwNDI4L2F1dG8vczMvYXdzNF9yZXF1ZXN0Il1dLCJleHBpcmF0aW9uIjoiMjAyNC0wNC0yOFQyMDozMzowNi43NTU5NjRaIn0=" \
  -F "x-amz-signature=ccebc0c8ac157cd7b7bc0e3baba961540dda597c86a57a7fa6e74673eda31bff" \
  -F "file=@/path/to/your/image.png;type=image/png" \
  https://fly.storage.tigris.dev/public.fffs.absurd.chat

Hello,

I couldn’t try the exact cURL request because it has expired. I replicated the same policy for the bucket post-policy-test; the policy looks like this:

{
  "conditions": [
    ["eq", "$bucket", "post-policy-test"],
    ["content-length-range", 0, 209715200],
    ["eq", "$x-amz-date", "20240505T203306Z"],
    ["eq", "$x-amz-algorithm", "AWS4-HMAC-SHA256"],
    ["eq", "$x-amz-credential", "tid_NhIvhlFpTWpfZDryFcfzVwglbgFbJZoxNWerSykoyUyuftmhXQ/20240505/auto/s3/aws4_request"]
  ],
  "expiration": "2024-05-05T20:33:06.755964Z"
}

My cURL command:

curl --location --request POST 'https://fly.storage.tigris.dev/post-policy-test' \
  --header 'Content-Type: multipart/form-data' \
  --form 'bucket="post-policy-test"' \
  --form 'x-amz-date="20240505T203306Z"' \
  --form 'x-amz-algorithm="AWS4-HMAC-SHA256"' \
  --form 'x-amz-credential="tid_NhIvhlFpTWpfZDryFcfzVwglbgFbJZoxNWerSykoyUyuftmhXQ/20240505/auto/s3/aws4_request"' \
  --form 'policy="eyJjb25kaXRpb25zIjpbWyJlcSIsIiRidWNrZXQiLCJwb3N0LXBvbGljeS10ZXN0Il0sWyJjb250ZW50LWxlbmd0aC1yYW5nZSIsMCwyMDk3MTUyMDBdLFsiZXEiLCIkeC1hbXotZGF0ZSIsIjIwMjQwNTA1VDIwMzMwNloiXSxbImVxIiwiJHgtYW16LWFsZ29yaXRobSIsIkFXUzQtSE1BQy1TSEEyNTYiXSxbImVxIiwiJHgtYW16LWNyZWRlbnRpYWwiLCJ0aWRfTmhJdmhsRnBUV3BmWkRyeUZjZnpWd2dsYmdGYkpab3hOV2VyU3lrb3lVeXVmdG1oWFEvMjAyNDA1MDUvYXV0by9zMy9hd3M0X3JlcXVlc3QiXV0sImV4cGlyYXRpb24iOiIyMDI0LTA1LTA1VDIwOjMzOjA2Ljc1NTk2NFoifQ=="' \
  --form 'x-amz-signature="<removed>"' \
  --form 'file=@"/Users/jmj/Downloads/SampleJPGImage_30mbmb.jpg"' \
  --form 'key="tiger.png"'

To close this one out – a colleague and I synced on a different channel and it was a DIO client issue on how it constructed the multipart‑file upload without specifying filename. This issue was resolved by properly constructing the multipart/form-data file upload.