Logistics Object Storage: Presigned PDF/CSV Downloads with Wrong Content-Disposition
Private logistics exports need two contracts, not one: the signed link must authorize the object, and the object response must describe how the recipient should receive it. If a PDF opens in a browser when it should download, or a CSV arrives with an internal key as its filename, signing is rarely the interesting failure. The usual fault is that filename and response metadata were left until…
The article discusses the issue of presigned PDF/CSV downloads with incorrect Content-Disposition in logistics object storage. The key points are that the filename and response metadata should be set before issuing a signed GET link, and the object key should be treated as an internal identifier rather than a customer filename. The article provides a design decision for how object storage should handle presigned downloads, emphasizing the importance of invariants such as privacy, link expiration, media type selection, and disposition settings.
The uploader creates an immutable export record containing the object key, media type, customer filename, owner, and expiry policy, which is then verified before issuing the signed link. This approach ensures that the intended disposition is explicit and prevents issues with browsers rendering PDFs inline or CSVs being displayed as text.
The article concludes that the failure boundary is deliberately boring, and only a metadata check should determine whether the link is issued or not.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.