AWS API signed POST request with Javascript

Question

What I'm trying to do: Ultimately: I want to populate an AWS Kinesis stream from a browser extension (Safari, Chrome). I need to send the request to AWS using a signing process (v4); this involves setting headers and encrypting them (on a distant server with the aws secret key) to finally join those to the request.

Amazon requests the header "Host" to be explicitly defined… However Javascript strictly disallow setting it (and a bunch of others, for good reasons)

I must be missing something—how can I do this?

sources: http://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html - the example is in Python but it shows how server-side they intend to use the Host header

notes: I'm currently using POST; the example's comments describing the GET and query string mention the "Host" as well: it must exist as a header in the request

also: Using a similar setup, I managed to have a file uploaded from the client directly to an S3 bucket–the autorisation process is slightly different (no requirement for 'Host').

Answer 1

The Host: header is being filled in and parsed from the given URL by the JS XHR itself when you execute it, same as with curl, e.g.

curl -v -X POST http://example.org/foo

...will automatically add the header Host: example.org...

For AWS you'll still need to add it to the canonical_headers list for signing though (and in all lowercase), as described in your linked example. That part has nothing to do with actually establishing a connection though.