Setup and security guide
Use your S3 bucket without the AWS console.
orazine.net is a browser-based object workspace. A dedicated browser worker signs S3 requests locally and sends them directly to your bucket. No credentials or files pass through an orazine.net server.
Create an IAM user or access key
Create credentials in the AWS account that owns the bucket. Grant only the operations this workspace needs, scoped to the intended bucket.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": "arn:aws:s3:::YOUR_BUCKET"
},
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
"Resource": "arn:aws:s3:::YOUR_BUCKET/*"
}
]
}Allow browser requests with bucket CORS
In the S3 console, open the bucket, choose Permissions, then edit Cross-origin resource sharing (CORS). If you host the client yourself, replace https://orazine.net with the exact HTTPS origin where you publish it.
[
{
"AllowedHeaders": ["*"],
"AllowedMethods": ["GET", "PUT", "DELETE", "HEAD"],
"AllowedOrigins": ["https://orazine.net"],
"ExposeHeaders": ["ETag"]
}
]Create and use a client key
Return to the login screen and choose Custom connection. Enter the access key ID, secret access key, bucket name, AWS region, endpoint, and session token when using temporary STS credentials. Generate the client key, then store it as securely as the original AWS credentials.
A client key contains your AWS credentials in an encoded, not encrypted, form. Prefer short-lived STS credentials, grant access only to the required bucket or prefix, clear copied keys from the clipboard, and never share the client key publicly.
Connect
Paste the client key into the login at the top of the home screen. You can then list, upload, preview, download, and share objects. Deletion must be enabled explicitly for each connected session. Inactive and background sessions disconnect automatically.
Use a dedicated browser profile
Create a separate Chrome or Edge profile named orazine.net Secure, do not sign it into browser sync, and leave every extension disabled. Bookmark https://orazine.net and use that profile only for S3 access. A separate browser installation with no add-ons provides an even clearer boundary.
Worker isolation keeps active signing material out of the page, but an extension allowed to read or modify this site can still intercept credentials while they are typed or pasted. A clean profile reduces that remaining risk.
Host your own copy
Download the source archive, extract it, and serve the directory from an HTTPS static host. Update your bucket CORS origin to that host, then use the included publish.ps1 script when publishing through S3 and CloudFront.