Use expiring delivery links without making private assets public.
Decide what is private
Private originals, paid downloads, and temporary review files need a delivery authorization step. The application checks the viewer’s rights and issues a short-lived URL for the exact object or transformation. The URL is a bearer capability: anyone holding it can use it until it expires.
Keep caches aligned with permissions
Choose an expiration long enough for a download but short enough for the access policy. If authorization can be revoked instantly, a plain presigned URL may not meet the requirement. A CDN token, proxy, or session-bound approach may be needed, with explicit cache-key and purge behavior.
Do not log the secret link
Avoid putting signed query strings in analytics, error reports, or third-party referrers. Test clock skew and range requests for large video files. Make the application able to refresh a link without asking users to restart an otherwise valid download.
A concrete acceptance test
Open a private URL before authorization, during its valid window, and after expiry. Repeat with a byte-range request and inspect logs to ensure the signed query string was not captured. Run this test with a realistic asset and record the observed state, output URL, and failure reason.
Implementation check
- Authorize the exact asset before signing a delivery URL.
- Test expiration and byte-range requests.
- Remove signed query strings from routine telemetry.
Related guides
Primary reference: Official documentation.
Related field note
Continue with A decision matrix for delivery URL signing.