{
  "id": 18051818,
  "title": "Private Logistics Image Thumbnails: Signed URL Delivery and Per-Tenant Object Storage",
  "url": "https://urgent.news/2026/11/04/private-logistics-image-thumbnails-signed-url-delivery-and-per-tenant",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-04T01:48:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/holdenfox8476/private-logistics-image-thumbnails-signed-url-delivery-and-per-tenant-object-storage-4jh0"
  },
  "original_language": "en",
  "account": "Private thumbnail delivery in logistics apps involves keeping image bytes and resized variants in object storage, while preserving ownership and metadata in the database. The application then provides a short-lived signed URL to the browser, ensuring the UI can deliver images without making them public assets. The database is crucial for determining tenant ownership, storing image dimensions, processing state, and retention decisions. It should not carry the image blobs themselves. The object key is useful for a second access check, but not an authorization policy. A naming convention like tenantId/userId/imageId/size.webp, followed by tenant and user verification, simplifies recovery and support exports. Backup and restore operations follow the same principle: the database stores snapshot information, and object storage holds the files. Short-lived signed URLs are essential for security and efficiency. The URL's lifetime should correspond to the screen's job, whether it's a few minutes for a thumbnail request or longer for a background export with a separate audit trail. The separation of URLs from long-lived credentials also simplifies deletion, as a tenant removal transaction can handle database row marking, object deletion, and recording attempted deletions without a massive database transaction. When deciding between using object storage or database blobs, the latter is beneficial for atomic updates with small records and querying through the same transaction. However, it becomes cumbersome with numerous thumbnails, backups, or application replicas moving bytes instead of serving shipment data. Database blobs also pose challenges with large binary columns, complex restore windows, and maintenance. Object storage, on the other hand, offers direct byte delivery, many independent objects, and leaves metadata and authorization to the application. However, it requires coordination through a database record, naming convention, cleanup worker, and upload policy for failed uploads. In a tenant migration, deciding where to store older than 24-hour-old images, checking key prefix boundaries, recording checksums before resizing, and creating reconciliation jobs that explain mismatches are essential tasks. The database remains small and queryable, while storage handles bytes more efficiently.",
  "summary": "Private thumbnail delivery is an access-control problem before it is a storage problem. For a logistics app with multiple tenants, keep image bytes and resized variants in object storage, keep ownership and image metadata in the database, and hand the browser a short-lived signed URL. That gives the UI simple delivery without turning every image into a public asset. The database still matters. It…",
  "key_points": [
    "Private logistics apps store image bytes in object storage, metadata in database",
    "Signed URLs provide short-lived access to images, ensuring security and efficiency",
    "Database handles tenant ownership, image dimensions, and retention decisions"
  ],
  "editors_take": "Decoupling image bytes from database records optimizes application performance by offloading heavy binary transfers to object storage while maintaining strict tenant security through short-lived signed URLs.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}