{
  "id": 14531144,
  "title": "Evaluating Browser Storage Handoffs: React PUTs, Express Signing, Private Object Reads",
  "url": "https://urgent.news/2026/10/14/evaluating-browser-storage-handoffs-react-puts-express-signing",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T20:40:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/lukasschmidt295/evaluating-browser-storage-handoffs-react-puts-express-signing-private-object-reads-2kjj"
  },
  "original_language": "en",
  "account": "To handle private object storage uploads and signed downloads, first set up a bucket during deployment. When an upload occurs, Express authenticates the user, generates a server-owned key, records the user_id and MIME type in the database, and then requests a presigned PUT URL from storage. React uploads the file to this returned URL using the PUT method. The platform credentials should remain on the server and never be sent with the browser's follow-up request.\n\nUpon a successful upload, verify the object before marking the database row as ready. For private reads, the server confirms ownership and provides a new signed download URL. There should be no permanent public URLs in this design.\n\nIn Python, the control-plane code utilizes HTTP requests to interact with the storage system. It includes a `post_with_backoff` function to handle retries in case of failures, such as a 429 response. The `create_private_upload` function formats the path and sends a POST request to create the presigned URL. This approach ensures a seamless transfer process without burdening the application server with file transfer tasks.",
  "summary": "Short answer: use a private object storage bucket, have an Express server create a short-lived presigned PUT URL, and let React upload the bytes directly; issue another signed download URL when an authorized user needs the object. This keeps file transfer out of the application server, but it is not a good fit for permanent public links or a deployment that needs self-service bucket CORS rules.…",
  "key_points": [
    "React uses PUT method for private object storage uploads",
    "Express generates server-owned key and presigned URL",
    "Python handles retries with backoff function for uploads"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}