Cloud Storage CORS Support for Direct Browser Uploads: R2 vs S3 vs Wasabi

When a logistics portal needs to upload private delivery photos directly from a browser, Cloudflare R2 emerges as the most suitable choice among other cloud storage options like Amazon S3 and Wasabi. The primary reason behind this recommendation is R2's combination of low storage costs and free egress, which makes it an ideal fit for this specific access pattern.

For the logistics portal, the least complex design involves a private bucket paired with short-lived presigned URLs. This approach simplifies the implementation and minimizes complexity. However, the decision-making process should primarily focus on retention and retrieval aspects rather than just the sticker price.

To determine the cost-effectiveness of the chosen cloud storage, one must consider the total bytes retained and the frequency of data egress from the service. For instance, if a 10 MB proof-of-delivery image is retained for 30 days and there are 100,000 such images, the retained payload would amount to approximately 1,000,000 MB. This calculation helps in understanding the storage costs associated with the data.

The actual upload process involves a private bucket, where the application authenticates the user, validates the shipment and object key, and generates a presigned URL. The browser then sends the file directly to this URL without requiring access to any platform credentials. The browser does not need a public object URL, ensuring that the upload path remains private from the first request.

When choosing between Cloudflare R2, Amazon S3, and Wasabi, it is crucial to consider the specific requirements of the workflow. While R2 provides a low storage cost and free egress, making it suitable for the given scenario, S3 offers broader global coverage and more granular configuration options. Wasabi, on the other hand, might be considered only after thoroughly modeling the egress restrictions against the actual browser path.

A key aspect to address in this setup is CORS (Cross-Origin Resource Sharing) support for direct browser uploads. Although R2 does not have built-in CORS configuration, it is possible to implement this capability by creating a presigned URL for the upload request. This presigned URL authorizes a single object operation and ensures that the browser sends the correct allowed origin, method, and headers, aligning with the upload request.

Thus, CORS support is a product boundary that needs to be addressed rather than being a client-side problem.

The expiration of a download link should be shorter than the object's lifespan. This distinction ensures that the link remains valid only for the duration of the dispatcher's workflow, while the object remains recoverable for a longer period. By keeping the original image until the dispute window closes and deleting abandoned multipart uploads deliberately, the logistics portal can effectively manage costs and maintain evidence when an exception occurs.

In summary, Cloudflare R2 emerges as the best default option for a logistics portal that requires direct browser uploads of private delivery photos. Its low storage costs, free egress, and the ability to implement CORS support make it an ideal choice for this specific use case. However, it is essential to carefully consider retention and retrieval requirements, as well as the associated costs, before making a final decision.