You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/r2/api/s3/presigned-urls.mdx
+35-27Lines changed: 35 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,8 @@ title: Presigned URLs
3
3
pcx_content_type: concept
4
4
---
5
5
6
+
import {Tabs, TabItem } from"~/components";
7
+
6
8
Presigned URLs are an [S3 concept](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html) for sharing direct access to your bucket without revealing your token secret. A presigned URL authorizes anyone with the URL to perform an action to the S3 compatibility endpoint for an R2 bucket. By default, the S3 endpoint requires an `AUTHORIZATION` header signed by your token. Every presigned URL has S3 parameters and search parameters containing the signature information that would be present in an `AUTHORIZATION` header. The performable action is restricted to a specific resource, an [operation](/r2/api/s3/api/), and has an associated timeout.
7
9
8
10
There are three kinds of resources in R2:
@@ -141,15 +143,41 @@ export default {
141
143
## Differences between presigned URLs and R2 binding
142
144
143
145
- When using an R2 binding, you will not need any token secrets in your Worker code. Instead, in your [Wrangler configuration file](/workers/wrangler/configuration/), you will create a [binding](/r2/api/workers/workers-api-usage/#3-bind-your-bucket-to-a-worker) to your R2 bucket. Additionally, authorization is handled in-line, which can reduce latency.
144
-
145
146
- When using presigned URLs, you will need to create and use the token secrets in your Worker code.
146
147
147
148
In some cases, R2 bindings let you implement certain functionality more easily. For example, if you wanted to offer a write-once guarantee so that users can only upload to a path once, with pre-signed URLs:
148
149
149
-
- With R2 binding: You only need to pass the parameter once.
150
-
- With presigned URLs: You need to sign specific headers and require the sender to send the same headers.
151
-
152
-
You can modify the previous example to sign additional headers:
150
+
- With R2 binding: You only need to pass the parameter once.
151
+
- With presigned URLs: You need to sign specific headers and require the sender to send the same headers.
152
+
153
+
<Tabs>
154
+
<TabItemlabel="R2 binding example">
155
+
156
+
If you are using R2 bindings, you would change your upload to:
// No objects will have been uploaded before September 28th, 2021 which
162
+
// is the initial R2 announcement.
163
+
uploadedBefore: newDate(1632844800000),
164
+
},
165
+
});
166
+
if (existingObject?.etag!==request.headers.get("etag")) {
167
+
returnnewResponse("attempt to overwrite object", { status: 400 });
168
+
}
169
+
```
170
+
171
+
When using R2 bindings, you may need to consider the following limitations:
172
+
173
+
- You cannot upload more than 100 MiB (200 MiB for Business customers) when using R2 bindings.
174
+
- Enterprise customers can upload 500 MiB by default and can ask their account team to raise this limit.
175
+
- Detecting [precondition failures](/r2/api/s3/extensions/#conditional-operations-in-putobject) is currently easier with presigned URLs as compared with R2 bindings.
176
+
177
+
Note that these limitations depend on R2's extension for conditional uploads. Amazon's S3 service does not offer such functionality at this time.
178
+
</TabItem>
179
+
<TabItemlabel="Presigned URL example">
180
+
You can modify the previous example to sign additional headers:
Note that the caller has to add the same `If-Unmodified-Since` header to use the URL. The caller cannot omit the header or use a different header, since the signature covers the headers. If the caller uses a different header, the presigned URL signature would not match, and they would receive a `403/SignatureDoesNotMatch`.
180
208
181
-
If you are using R2 bindings, you would change your upload to:
// No objects will have been uploaded before September 28th, 2021 which
187
-
// is the initial R2 announcement.
188
-
uploadedBefore: newDate(1632844800000),
189
-
},
190
-
});
191
-
if (existingObject?.etag!==request.headers.get("etag")) {
192
-
returnnewResponse("attempt to overwrite object", { status: 400 });
193
-
}
194
-
```
195
-
196
-
When using the bindings, you may need to consider the following limitations:
197
-
198
-
- You cannot upload more than 100 MiB (200 MiB for Business customers) when using the bindings.
199
-
- Enterprise customers can upload 500 MiB by default and can ask their account team to raise this limit.
200
-
- Detecting [precondition failures](/r2/api/s3/extensions/#conditional-operations-in-putobject) is currently easier with presigned URLs as compared with R2 bindings.
201
-
202
-
Note that these limitations depend on R2's extension for conditional uploads. Amazon's S3 service does not offer such functionality at this time.
209
+
</TabItem>
210
+
</Tabs>
203
211
204
212
## Differences between presigned URLs and public buckets
0 commit comments