Evaluating Browser Storage Handoffs: React PUTs, Express Signing, Private Object Reads
Short answer: use a private object storage bucket, have an Express server create a short-lived presigned PUT URL, and let React upload the bytes directly; issue another signed download URL when an authorized user needs the object. This keeps file transfer out of the application server, but it is not a good fit for permanent public links or a deployment that needs self-service bucket CORS rules.…
To handle private object storage uploads and signed downloads, first set up a bucket during deployment. When an upload occurs, Express authenticates the user, generates a server-owned key, records the user_id and MIME type in the database, and then requests a presigned PUT URL from storage. React uploads the file to this returned URL using the PUT method. The platform credentials should remain on the server and never be sent with the browser's follow-up request.
Upon a successful upload, verify the object before marking the database row as ready. For private reads, the server confirms ownership and provides a new signed download URL. There should be no permanent public URLs in this design.
In Python, the control-plane code utilizes HTTP requests to interact with the storage system. It includes a `post_with_backoff` function to handle retries in case of failures, such as a 429 response. The `create_private_upload` function formats the path and sends a POST request to create the presigned URL. This approach ensures a seamless transfer process without burdening the application server with file transfer tasks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
