title: Direct to S3 with client-side validations
body: <p>We are using <a href="https://github.com/sheerun/s3_file_field" rel="nofollow">s3_file_field</a> to upload videos directly to S3, and we are planning on using <a href="https://github.com/bcardarella/client_side_validations" rel="nofollow">client side validations</a> to make sure the uploads are within our size restrictions, but I'm worried that a hacker might be able to turn JS off, and upload a 500GB file to our S3 bucket.</p>
  
  <p>In the past, whenever I've used client-side validations, I've also had server-side validations backing them up, so I've never been too concerned about users turning JS off, but we can't have server-side validations here as we're going directly to S3.</p>
  
  <p>How easy is it for a hacker to get around client side validations? Is it just a case of turning JS off? Would it help if we disabled our upload form when JS is disabled?</p>
  
  <p>Should we be implementing a worker or observer to sweep uploaded videos, and run validations on them sometime after they've been uploaded, and before they can be accessed by users?</p>