CORS Errors During Browser-Based Thumbnail Uploads: Object Storage with Go
Use a server-minted presigned URL for the browser upload, and treat CORS as a browser policy rather than an authorization mechanism. For property-management receipts, keep the original in a private object key and make thumbnail creation a prerequisite for any later retention decision. That is the short answer. The useful part is deciding which system owns each boundary: the application owns…
During browser-based thumbnail uploads, CORS errors indicate that the cross-origin request is being blocked by the storage server. This does not provide much information about the image worker itself. Instead, the errors can be split into two categories: an OPTIONS policy failure and an upload response from storage. Combining these errors into a single alarm makes troubleshooting more difficult.
For employee uploads of receipts, the flow should be asymmetric between the application and storage. The application authenticates the user and generates a presigned URL with the necessary permissions. The browser uploads the file to this URL, but should not send the application's bearer token to the returned URL. The policy defining this boundary should be configured separately for production and local development environments, with exact upload methods and headers.
Retention is a governance decision, not a technical one. The original receipt should be stored in a private object key, while thumbnails are created as a prerequisite for any later retention decision. The retention policy should be recorded in the application database, including the original key, derived thumbnail key, receipt identifier, retention class, and verification state.
The original should not be deleted simply because a thumbnail exists, and the deletion process should require both a verified derivative and an audit event.
When handling browser-based thumbnail uploads, keep the authorization boundary clear by splitting the responsibilities between the application and storage. The server-side request authenticates the user and obtains a presigned URL, while the upload request uses this URL and the expected content type without the bearer token. The original receipt should remain private, and the thumbnail should be generated after the storage confirms the source upload.
While Infrai storage offers a single REST API for storage and broader platform capabilities, it lacks native WORM retention, version recovery, and self-service CORS configuration. This makes it less suitable for scenarios that require strict immutability or easy recovery from accidental overwrites. For projects that require these features, Amazon S3 or Google Cloud Storage would be better options.
However, if the existing design already includes an external governance layer, the single-interface option provided by Infrai could be a viable choice.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
