Node.js File Exports Using Short-Lived Presigned Download Links

·5 views

The article recommends authorizing each export request in the application, then returning a short-lived, object-specific presigned URL so large files bypass the app's servers. Such a link acts as a bearer credential, so it should be handled like a password that expires on a fixed schedule. Exports move through states such as queued, ready, expired, and revoked, and downloads are allowed only for ready records whose deadlines have not passed. Object keys are generated server-side from opaque IDs to avoid authorization flaws in path handling. The approach fits completed, non-sensitive results, but data needing instant revocation or per-viewer watermarking requires a more controlled delivery layer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PHP Session Upload Progress Advisory: CVE-2026-115560 Mitigation and Scope

PHP published an informational notice on October 23, 2026, about CVE-2026-115560, which applies only when the session serialize handler is set to php_binary or php_serialize and then changed at runtime to php before session_start() with session upload progress enabled. PHP describes remote code execution through this path as unlikely and recommends disabling upload progress until the next regular bugfix release, while noting that applications that never change the handler at runtime can keep it enabled. A full advisory is promised, but no complete list of affected versions or CVSS score has been published yet, and cPanel has said affected versions remain unknown. Red Hat states the recommended mitigation is fully protective and gives guidance for enforcing it in FPM and Apache. A ZoomEye search for app="PHP" returned about 111 million PHP fingerprint matches, which reflects general PHP deployment rather than confirmed vulnerable systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Timeouts Are Not Failed Bookings: Designing Duplicate-Safe AI Actions

A DEV Community article argues that an AI assistant should not assume a booking failed just because a request timed out, since the service may have already saved it. It recommends treating each booking as one durable operation with a unique identifier that excludes private customer data. The author proposes a state model (Prepared, Submitted, Confirmed, Uncertain, Escalated) that separates confirmed failures from unknown outcomes. Examples draw on Google Calendar's client-supplied event IDs and Stripe's idempotency keys, with a warning that each provider's documented guarantees must be checked. The piece advises verifying uncertain writes via supported read paths and escalating ambiguous cases to a person rather than creating duplicates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Email and Phone Normalization Can Go Wrong in Contact Data

A contact lookup can fail when formatting differs, such as spaces in a phone number, and aggressive cleaning may then corrupt valid identifiers. The article stresses that normalization produces a consistent representation, while validation only checks structure and neither proves a person owns an address or number. Email handling should follow a documented domain policy, since providers differ on dots, plus-addressing, and letter case, and stripping plus suffixes can merge identifiers that should stay distinct. Phone numbers without country context are ambiguous, so the guidance is to capture country explicitly, use a maintained parsing library, and keep extensions separate. Original inputs should be retained only under access controls, and uncertain values should trigger review rather than silent guessing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Safer JSON Snapshot Updates Use a Temporary File Before Replacement

A technical write-up describes how a small local job can avoid corrupting its saved JSON state. Opening the destination file directly erases the prior result before serialization completes, so a mid-write failure can leave readers with a partial snapshot. The proposed approach writes to a temporary file in the same directory, flushes and syncs it, then replaces the original. Three local tests on synthetic files confirmed that successful writes, serialization errors, and replacement failures all leave the previous data intact. The author notes the helper lacks version checks or a writer lock, so concurrent writers could still overwrite each other.

0 comments Read more at DEV Community