Glossary
Presigned URL
A presigned URL is generated by a system that already has permission to access a storage object, and encodes a scoped, time-limited grant directly into the link itself — whoever holds the URL can access exactly that object until it expires, without needing their own credentials checked at the time of access. This lets a client fetch or upload a file directly from storage, without routing the actual data transfer through the application server.
Because possession of the URL is what grants access, a presigned URL that leaks — logged in full, pasted somewhere public, cached by an intermediary — is usable by whoever finds it until it expires. Keeping the expiry window as short as the actual use case allows is the main lever for bounding that exposure.