Vercel Blob adds time-bound signed URLs

Summary

Eliminates server round-trips for file uploads by streaming directly from browser to Blob storage, and keeps long-lived tokens server-side while issuing narrow, expiring URLs to clients. Reduces attack surface for file operations.

Why it matters

Eliminates server round-trips for file uploads by streaming directly from browser to Blob storage, and keeps long-lived tokens server-side while issuing narrow, expiring URLs to clients. Reduces attack surface for file operations.

Sources

1. 1.A signed URL is a scoped URL with an expiry that allows you to upload, download, inspect, or delete a specific object without giving access to your entire Blob store
2. 2.Each URL is scoped to a single operation (`put`, `get`, `head`, or `delete`), a single pathname, and an expiry you choose, up to 7 days
3. 3.a URL signed for a `GET` can't be reused as a `PUT`
4. 4.Upload URLs (`put`) support multipart, so the browser can stream large files straight to Blob storage without round-tripping through your server
5. 5.your long-lived `BLOB_READ_WRITE_TOKEN` never leaves the server
6. 6.Update `@vercel/blob` to `2.4.0`