Tenant-isolated thumbnail uploads need separate controls for CORS, authorization, and private reads

Direct browser uploads of support thumbnails to private object storage can reduce application bandwidth, but they spread security duties across CORS and signed requests. The article argues that a successful upload proves little on its own, since CORS is only a browser permission check and a presigned request authorizes one specific operation. It also warns that a stored thumbnail is still a failed workflow if the support console cannot read it, so the display path needs a short-lived authorized read or proxy. The recommended design derives object keys from server-side tenant records with opaque, immutable names, and it measures preflight, upload, resize, and display as separate stages. Where that contract cannot be run reliably, the author suggests server-mediated uploads instead.