{
  "id": 4343222,
  "title": "Best Object Storage for Private Image Thumbnails and Signed Links in Node.js",
  "url": "https://urgent.news/2026/08/30/best-object-storage-for-private-image-thumbnails-and-signed-links-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-30T04:20:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/zanesterling7589/best-object-storage-for-private-image-thumbnails-and-signed-links-in-nodejs-465c"
  },
  "original_language": "en",
  "account": "To store private originals, generate thumbnails, and issue signed download links, a SaaS app should follow a four-step ownership boundary process. First, the application authenticates the user. Second, the storage system persists the original image. Third, a worker generates thumbnail variants. Lastly, the application creates signed download links after verifying tenant access.\n\nThe worker should write a deterministic key and only mark the database row as ready after the storage system accepts the object. A client that sees a pending row should retry the application endpoint, not the bucket. This approach ensures that retries converge on the same result, preventing the creation of duplicate objects.\n\nWhen implementing this in Node.js, the worker can use the Infrai plain REST surface, which requires only HTTP requests without needing a specific storage SDK or client library. The code should include an explicit method, bearer token, idempotency key, bounded retries, and surfacing the response body for troubleshooting purposes.\n\nFor example, the code snippet provided uses the sha256 hashing algorithm to create a deterministic key based on the bucket, key, and content digest. The API origin, API key, and content are obtained from environment variables. The code then creates the PUT object URL, sets the necessary headers, including the Authorization bearer token and Idempotency-Key, and sends the request using the requests library. The code includes retry logic for handling rate limiting (429) responses.",
  "summary": "The resizing boundary decides this architecture before the storage vendor does. Short answer: keep private originals and generated thumbnails in object storage, resize in an application worker or a dedicated image service, record every variant in the application database, and give clients short-lived signed GET links. Don't treat the bucket as an image processor or a catalog. A Node.js SaaS can…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Your Supabase Storage bucket is public - signed URLs will not save you",
        "url": "https://urgent.news/2026/08/28/your-supabase-storage-bucket-is-public-signed-urls-will-not-save-you",
        "published": "2026-08-28T20:59:51.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}