Understanding Presigned S3/R2 URLs: Ephemeral Access Keys Explained
A technical guide to presigned S3 and Cloudflare R2 URLs: HMAC signatures, short TTL expiration, and direct browser-to-bucket transfers without proxy bottlenecks.
The Inefficiency of Proxy Upload Architectures
In traditional web apps, when a user uploads a file, the data travels from the browser to the web server, which buffers the file before uploading it to cloud storage. This proxy architecture wastes server memory, increases network latency, and exposes user files to server disk caches.
Modern secure cloud architecture utilizes presigned URLs to enable direct client-to-storage transfers.
Key Architectural Takeaways
- Presigned URLs use HMAC cryptographic signatures with strict expiration limits.
- Direct browser-to-storage uploads bypass server memory, improving speed and security.
- Temporary 5-minute viewing tokens prevent persistent link redistribution.
Cryptographic HMAC Signatures
When a user creates a vault, Locky's backend generates a cryptographically signed PUT URL valid for 300 seconds. The URL contains an AWS Signature Version 4 (SigV4) HMAC-SHA256 signature binding the request to exact headers (content-type, size, metadata).
The browser uploads the file directly to private Cloudflare R2 storage. Once the 300-second window expires, the upload ticket becomes permanently invalid.
Ephemerality in Viewing Links
When a recipient enters the correct 4-digit PIN, Locky issues a temporary GET presigned URL valid for only 5 minutes. Even if the recipient copies the raw media asset URL, it ceases to work minutes later, preventing unauthorized hotlinking or scraping.
Try Zero-Knowledge Ephemeral Sharing
Need to share a photo or video privately without permanent digital footprint? Locky strips location metadata client-side in your browser, locks media behind a 4-digit numeric PIN, and guarantees automatic self-destruction in 24 hours.
Related Knowledge Base Guides
EXIF Metadata & Geotags: What Photos Reveal About Your Location
A deep dive into Exchangeable Image File Format (EXIF) data, GPS latitude and longitude tracking, and why client-side metadata sanitization is critical before sharing photos online.
Ephemeral StorageThe Dangers of Permanent Cloud Links: Why 24-Hour Self-Destruct Protects You
Why traditional cloud drives like Google Drive and Dropbox create persistent security vulnerabilities, and how automated ephemeral lifecycles eliminate link-rot and data leaks.