{
  "id": 19201856,
  "title": "Object Storage Thumbnails: Sharp Workers for Private-Bucket Resizing and Signed URLs",
  "url": "https://urgent.news/2026/11/09/object-storage-thumbnails-sharp-workers-for-private-bucket-resizing",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T19:39:50.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/thomasmoore157/object-storage-thumbnails-sharp-workers-for-private-bucket-resizing-and-signed-urls-435e"
  },
  "original_language": "en",
  "account": "In a private bucket setting, when generating object storage thumbnails for a B2B SaaS, the tenant and source revision must be part of the derivative identity. Thumbnails are created in a bounded worker and issued with a short-lived signed URL only after an application authorization check. Isolation is the key reliability decision, not the resize library. A thumbnail appearing correct but for the wrong tenant can still be an issue. An incident occurred when a valid thumbnail was placed in the wrong location due to overlapping requests from different tabs. To prevent this, generate thumbnails using a worker, and issue a short-lived signed URL after confirming application authorization. Ensure that the storage contract includes tenant and source revision information for all identities involved in the process.",
  "summary": "Short answer: for a B2B SaaS that serves private image thumbnails, make tenant and source revision part of the derivative identity, generate thumbnails in a bounded worker, and issue a short-lived signed URL only after an application authorization check. The reliability decision is the isolation boundary, not the resize library. A thumbnail can look perfect and still be the wrong tenant's object.…",
  "key_points": [
    "Thumbnails generated in private bucket setting for B2B SaaS",
    "Worker isolates reliability, not resize library",
    "Signed URL issued after authorization check with tenant and source revision"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}