Presigned URLs vs Proxy Uploads: When to Use Each for File Storage

·1 views

A software engineer has outlined the key trade-offs between presigned URLs and proxy-based file uploads for web applications. Presigned URLs, where the browser uploads directly to object storage via a short-lived credential, are recommended for most SaaS use cases because they avoid loading the app server with large payloads, reduce costs, and lower latency. Proxying uploads through a backend server is justified only in specific scenarios, such as compliance-mandated virus scanning, server-side file transformation before storage, or strict per-tenant quota enforcement. Security best practices for presigned URLs include having the backend generate the object key, setting short expiry windows, and keeping stored objects private with signed download links. Skipping these precautions, the author warns, effectively creates an unsecured public file drop with no access controls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Semantic Search Beats Keywords When Companies Can't Find Their Own Data

A poorly organized shared drive cost one company three days and $40,000 when a CEO couldn't locate a signed contract about liability caps in time. The core problem is that keyword search matches characters, not meaning — a contract labeled 'limitation of liability' stays invisible to a search for 'liability cap.' Semantic search solves this by converting text into numerical vectors that position documents by meaning, so a query about 'vacation days' can surface a passage about 'annual leave' even with no shared words. Embedding models capable of this can run locally on a laptop without cloud APIs, which directly addresses enterprise concerns about data privacy. The shift from word-matching to meaning-matching is what closes the gap between knowledge an organization possesses and knowledge it can actually retrieve.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Indie Hacker Documents First $3 Earned Selling AI-Free Headline Prompts

An indie developer launched a small digital product called 'headlines-no-ai-wrote' — a pack of 50 headline prompts sold for $3 via Gumroad as a single markdown file. The experiment is part of a self-imposed challenge to earn a first $100 while publicly logging every decision, result, and failure. Initial attempts to promote the product on Reddit yielded zero sales, though a writer friend praised the headline itself as the standout element. The creator shared the full 50-prompt pack for free with five newsletter-writer contacts as a grassroots distribution strategy before attempting a Hacker News post. The project doubles as a live case study in early-stage indie product marketing, with the creator sharing real numbers and daily updates openly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Telegram Returns HTTP 200 for Deleted Bots, Making Standard Link Checks Unreliable

Telegram serves an HTTP 200 status code for bot URLs even when the bot has been deleted or never existed, meaning standard link checkers falsely report dead bots as live. A developer discovered this issue while building a catalog of Telegram Mini Apps, where every entry appeared valid despite some being defunct. The reliable workaround is to inspect the Open Graph title tag in the page's HTML: a live bot displays its own name, while a deleted or non-existent one shows a generic Telegram placeholder string. Using this method, a simple script can accurately distinguish live bots from dead ones without relying on the HTTP status code. The developer notes this approach depends on Telegram's current page markup rather than an official API, so the placeholder strings should be monitored periodically for changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TinyNpm VS Code Extension Shields Apps from npm Supply Chain Attacks

TinyNpm is a newly released Visual Studio Code extension designed to help developers guard against npm supply chain attacks and dependency risks. The tool recommends package versions that are a specified number of days old, reducing exposure to malicious or compromised recent releases. It also removes the caret symbol from version entries, giving developers tighter control over which package versions their applications use. When hovering over packages, users receive warnings about stale packages, high dependency counts, and low download numbers. The extension pulls its data from the npm API and is available for download on the VS Code Marketplace.

0 comments Read more at DEV Community