Healthtech exports: signed URLs and object storage for large, authorized downloads

Large healthtech exports may be generated by one worker and downloaded later by a different session, so the author recommends a delivery design that keeps load off the application. Authentication and authorization stay in the app, and the finished file is written to object storage with a short-lived signed URL given to the authorized browser. Serving bytes from the app server is reserved for small, ephemeral files consumed within one request, since large downloads tie up workers, connections, and local disk. Because a signed URL works as a time-limited capability, it should only be issued after tenant ownership and a completed export state are verified, and object keys should be opaque rather than containing sensitive identifiers. The article treats an oversized-request error as a signal to rethink the delivery boundary rather than raising limits, and notes that traffic patterns and residency rules determine the actual trade-offs.