Can you provide an example of backend setup for signed uploads

[gmcamposano]

There is the option to provide the backend api route for a signed upload, but i cannot figure out what does that backend expect. Does it only expect a type of response to approve it? Please provide an example of an api setup.

https://next-cloudinary.spacejelly.dev/use-cases/uploading-images-and-videos

[gmcamposano]

Can you please evaluate?
I am still kindda confused. If a user discovers the api call the app is doing, he can then use the endpoint to fill up my cloudinary's resources.

import { v2 as cloudinary } from 'cloudinary'

export default async function handler(req, res) {
  const body = JSON.parse(req.body) || {}
  const { paramsToSign } = body
  try {
    const signature = cloudinary.utils.api_sign_request(
      paramsToSign,
      process.env.CLOUDINARY_API_SECRET
    )
    console.log(signature)
    res.status(200).json({ signature })
  } catch (error) {
    console.log(error)
    res.status(500).json({ error })
  }
}

used this as guide for anyone who needs it: https://www.youtube.com/watch?v=Z7LwjMIeDt0&t=906s

[colbyfayock]

hey @gmcamposano i also have the sample code here: https://next-cloudinary.spacejelly.dev/components/clduploadwidget/basic-usage#signed

this is just an example of how to do this. there are different use cases involved here

if youd like to add more security, you could consider an authentication service that you could validate that the API request is coming from an authenticated session

NextAuth.js is a good one in the open source world. Clerk is another good one in the paid service world (though they have a free tier)

[gmcamposano]

You are correct, it was on the website. I was going crazy looking for it.
Yes I thought about next auth having to check the backend for a session or jwt. But anyone that has a session, can be able to cause some damage.

[colbyfayock]

sure, depending on the use case. being able to allow someone (or anyone) to upload may be what the website developer wants, such as a public image hosting service

if you need more than simple session based auth, you could consider adding roles, where only people with a specific role can successfully make the request