Case Study · Storage · 2023 — 2024

Object Storage — validated uploads, signed access

Object storage with validated uploads, signed-URL access control, and CDN-style retrieval.

Spec Sheet

Role

Full-stack engineer

Timeline

2023 — 2024

Status

In production

Surface

Upload + delivery API

Stack

Node.js · S3 SDK

Data

Cloudflare R2 · CDN

01

Problem

User-generated files (documents, images) needed to be stored and served at scale without routing every byte through the application server, which was a bottleneck and a cost sink. Uploads also had to be validated and access-controlled — not every file should be public, and not every upload should be trusted.

02

Context & constraints

A product handling sensitive merchant documents. Files had to be cheap to store and fast to serve globally, but access had to be authorized per-request — a public bucket was not an option.

Direct uploadsbytes shouldn't transit the app server
Authorized accessevery read requires a time-limited grant
Validationtype and size enforced before the object lands
03

Architecture

Request path

Client

request upload

→

Backend API

validate

→

Signed URL

scoped

→

R2

direct PUT

→

CDN

cached read

Failure recovery & consistency

Bad type/size

rejected

→

No grant

403

→

Expired URL

re-sign

→

Access

granted

04

Implementation

Upload

  • ·Presigned PUT URLs scoped to type + size
  • ·Client uploads directly to R2
  • ·Server records metadata on completion

Access

  • ·Presigned GET URLs with short expiry
  • ·Per-request authorization check
  • ·CDN caching for hot, public-safe objects

APIs

  • ·POST /uploads (returns signed URL)
  • ·GET /files/:id/url (returns signed read URL)
  • ·S3-compatible SDK against R2
05

Key decisions

01

Presigned URLs for direct transfer

Clients upload and download straight from R2 using short-lived signed URLs. The app server issues grants but never proxies file bytes, removing it as a bottleneck and cost center.

02

Validate before the object lands

Signed upload URLs are scoped to an allowed content type and max size, so invalid uploads are rejected by storage itself rather than discovered after the fact.

03

R2 for zero egress fees

Cloudflare R2's S3-compatible API meant minimal code change versus S3, while its lack of egress charges made global, CDN-fronted delivery economical at scale.

06

Tradeoffs

Chose

·Direct client ↔ R2 transfer via signed URLs

·S3-compatible API for portability

·Short URL expiry for tighter access control

Gave up

·Server-side stream processing of uploads

·Permanent public links (expiry adds re-signing)

·Single-provider lock-in convenience

07

Outcome

0

file bytes routed through the app server

global

CDN-fronted delivery with low latency

100%

reads gated by a time-limited grant