How to let browsers upload large media while the application keeps control.
Issue a narrow upload grant
The browser asks your application for permission, then uploads to object storage using a short-lived presigned URL. The application should choose the destination key and enforce the user’s quota before signing. A presigned URL inherits the signer’s permissions, so scope the signing identity and expiration carefully.
Confirm the object after upload
A successful browser request does not finish the workflow. Have the client call a completion endpoint, or consume a trusted storage event, then verify the object exists and its measured size and type are acceptable. Only then move the asset from pending to processing. Record a request ID so retries cannot create duplicate asset records.
Avoid predictable overwrite paths
An upload to an existing object key can replace that object. Generate opaque keys instead of using the original filename as the storage key. Keep the human filename as metadata after validation. Expire unused upload grants and clean up abandoned pending objects with a lifecycle policy.
A concrete acceptance test
Request an upload grant as one user, try it with an oversized file, and attempt a second upload to the same key. Confirm that the grant cannot overwrite an already published asset. Run this test with a realistic asset and record the observed state, output URL, and failure reason.
Implementation check
- Sign only a generated key for an authorized user.
- Verify size and type after storage confirms the upload.
- Expire abandoned grants and clean up pending objects.
Related guides
Primary reference: Official documentation.
Related field note
Continue with A migration plan for direct browser uploads.
