What are presigned upload URLs?

What are presigned upload URLs?

A presigned upload URL grants temporary permission to upload an object using a signed request. The backend creates it with storage credentials, allowing the browser to send file bytes without receiving the secret key itself. The URL is a sensitive capability, not a public application endpoint.

Bind permission to a specific upload

Before signing, authenticate the requester and check permission to contribute to the wedding. The backend should choose the bucket and a unique object key, then record the intended uploader, wedding, and expected file properties.

A presigned PUT URL authorizes the specified operation and object. Anyone holding it can use that permission until it expires. R2's presigned-URL documentation explains the signature and expiry behavior.

Understand the limits of the capability

A presigned URL is not automatically single-use. Reuse can replace the object at its key while permission remains valid. Keep its lifetime short, avoid leaking it into analytics or logs, and design finalization so later replacement cannot silently change an accepted image.

Do not assume that signing a claimed content type proves the uploaded bytes are an image. Also enforce upload quotas and verify actual object size rather than relying only on browser input.

Complete the application workflow

After uploading, the browser asks the backend to finalize the recorded upload. The server checks the object and applies the required validation before making the gallery item available.

For R2, presigned URLs use its S3 API endpoint rather than a custom delivery domain. Configure browser CORS for that upload path. Test expiry, failed uploads, repeat finalization, and attempts to claim another user's object. Temporary storage permission is only one step in a complete authorized upload workflow.