Presigned URLs and Lifecycle Control for Secure Browser Uploads to Object Storage

·2 views

The article argues that private e-commerce uploads with expiring download links should use short-lived, restricted presigned upload URLs issued by the backend. Under this approach the browser gets permission to upload one object for a limited time without receiving a storage credential, keeping large files off the application server. It stresses that the application must still handle authorization, object naming, retention, and deletion, and that storage APIs should be chosen by the deletion guarantees they can prove. The piece includes a sample Python client that requests a presigned URL with retry handling for rate limits, and notes that the Authorization header should not be sent to the delegated upload URL. It also says the expiry window is a policy choice that depends on file size and the cost of a leaked URL.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Production PWA Lessons: Manifests, Workbox Caching, and Push Notifications

A DEV Community article argues that standard PWA tutorials stop short of what matters once real users install and rely on an app. It highlights manifest choices such as tagging start_url with a query parameter to track installs separately, and using properly padded maskable icons listed as separate entries. The piece recommends Workbox over hand-written service worker code, with a Laravel-oriented example that pairs NetworkFirst for pages, StaleWhileRevalidate for API data, and CacheFirst for images. It also addresses the problem of stale UIs after deployments, where an older service worker keeps controlling open tabs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sepuluh dari 30 Image Docker Populer Masih Memuat Root CA eMudhra yang Dicabut

Browser seperti Chrome dan Firefox sudah mencabut kepercayaan pada root emSign ECC Root CA - G3 setelah insiden kunci lemah di delapan intermediate CA eMudhra. Namun, image container tidak ikut diperbarui secara otomatis, sehingga aplikasi di dalamnya bisa tetap menerima sertifikat dari root tersebut. Pemindaian terhadap 30 image Docker populer pada 24 Oktober 2026 menemukan 10 image yang masih membawa G3. Sebagian image yang tampak sudah diperbaiki juga ternyata masih menyimpan root yang dicabut, seperti salinan certifi milik pip atau cacerts milik Java. Para pengembang disarankan memeriksa seluruh trust store dalam image dan melakukan rebuild dengan --pull.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Structured Chatbot Search for Gaming Supplier Invoices Prioritizes Field Accuracy

A developer argues that a gaming company's chatbot for finding supplier invoices must return correct, specific fields rather than plausible-sounding answers. The proposed design pairs embedding-based semantic search to retrieve relevant invoice passages with a chat model that outputs schema-constrained JSON. Keeping retrieval and extraction separate makes it easier to tell whether errors come from finding the wrong evidence or mapping it wrongly. The article recommends preserving source identifiers, validating output, and marking absent fields as missing, and it proposes evaluating exact field accuracy on held-out invoices. It also compares OpenAI, Google Vertex AI, Cohere, Pinecone, and an OpenAI-compatible gateway by setup cost and fit.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ten Tools to Catch Bugs in AI-Generated Code Before Merge

Lint, type checks and security scans often pass AI-written pull requests, leaving logic flaws, missing edge cases and breaks outside the diff to reach main. A survey cited in the article found 28.2% of developers care a lot about AI code quality yet still rely on existing review to catch problems. The author recommends a four-layer pre-merge pipeline and ranks ten tools by the layer each fills, with Qodo placed first for checking whether code matches the linked ticket. Researchers found that up to 17% of LLM-written regression tests in 145 merged PRs asserted faulty behavior. Agent-written refactors also showed a higher rate of potential breaking changes than human ones, according to an MSR 2026 study.

0 comments Read more at DEV Community