Object Storage Thumbnails: Sharp Workers for Private-Bucket Resizing and Signed URLs
Short answer: for a B2B SaaS that serves private image thumbnails, make tenant and source revision part of the derivative identity, generate thumbnails in a bounded worker, and issue a short-lived signed URL only after an application authorization check. The reliability decision is the isolation boundary, not the resize library. A thumbnail can look perfect and still be the wrong tenant's object.…
In a private bucket setting, when generating object storage thumbnails for a B2B SaaS, the tenant and source revision must be part of the derivative identity. Thumbnails are created in a bounded worker and issued with a short-lived signed URL only after an application authorization check. Isolation is the key reliability decision, not the resize library.
A thumbnail appearing correct but for the wrong tenant can still be an issue. An incident occurred when a valid thumbnail was placed in the wrong location due to overlapping requests from different tabs. To prevent this, generate thumbnails using a worker, and issue a short-lived signed URL after confirming application authorization.
Ensure that the storage contract includes tenant and source revision information for all identities involved in the process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
