Secure Export Downloads Use Short-Lived Presigned Links Instead of Public Objects

·2 views

Exports should live in private storage and be delivered through temporary presigned URLs issued only after the application verifies the customer's session and export ownership. The authorization check belongs in the application, which should take the object key from its own records rather than from client input. Once that check passes, the server asks the storage API for a time-limited URL, passing the bucket, key, and expiration duration. The browser receives only that URL, so the storage service credentials never leave the server. The author also advises reading the API's discovery schema for exact parameter names instead of guessing them.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Comparer deux versions d'un contrat PDF mot à mot avec Python

Un PDF ne conserve pas d'historique des modifications, ce qui oblige à comparer directement les deux fichiers pour repérer les changements. L'article examine trois méthodes : comparaison des pages rendues pixel par pixel, comparaison du texte extrait ligne par ligne, et comparaison mot par mot. Sur une paire de contrats de test, le diff mot par mot identifie les mêmes cinq modifications même lorsque le texte est recomposé avec une autre mise en page, contrairement aux deux autres méthodes. L'auteur présente un script Python d'environ 120 lignes utilisant PyMuPDF et difflib, qui récupère les coordonnées de chaque mot modifié et réécrit les changements sous forme de commentaires dans le PDF. Il indique aussi qu'un logiciel de bureau, PDF Editor d'osFoundry, applique la même logique de comparaison mot par mot.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Senior Craft Depends on Context and Process, Not Just Code Output

An essay argues that the 'vibe coding' approach of prompting AI for finished code fails because it demands results without first establishing identity and context. The author frames a Be, Do, Have sequence that maps onto Context, Process, and Content, arguing that results depend on the upstream layers. Typical vibe-coding prompts, such as requests to build a login page or fix a race condition, are described as jumping straight to the final output. The piece contrasts this with a structured workflow in which the agent's role and phase-bound constraints are defined before any code is written. It concludes that clean, verifiable output emerges naturally only when the upstream context and process are locked in place.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ten Claude Skills a Freelancer Actually Uses Weekly for Client Work

A freelancer and consultant who has tested Claude skills over a year argues that most skill folders go unused and proposes a rule: only build a skill for a task done at least twice a week. The author identifies three common failures: overly broad descriptions, missing business context, and building for imagined tasks. They recommend first creating a shared context file covering the user's offer, clients, proof, goals, and preferred tone. The article then lists ten skills that survived this filter, including a client brief builder, proposal generator, and scope creep checker, with a summary table of inputs and outputs. A copyable SKILL.md template and a paid resource pack are also offered.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL's SET SESSION AUTHORIZATION alters both session and current user identities

PostgreSQL tracks two identities per session: the authenticated session user and the current user used for permission checks. SET SESSION AUTHORIZATION can change both, which is useful for controlled administrative tasks but risky in pooled or diagnostic contexts. Only superuser sessions may switch the session user to an arbitrary name, while other sessions are limited to their own authenticated name, and DEFAULT or RESET restore the original identity. The command cannot run inside a SECURITY DEFINER function and affects which roles later SET ROLE commands can assume, so reviews checking only current_user may miss it. The guidance recommends separate database roles, resetting session state before connection reuse, and verifying session_user, current_user, and current_setting('role') in tests.

0 comments Read more at DEV Community