Blob access control

[sakarisson]

Hey Vercel team, happy new year!

I'm starting on a new project, and I have a need to upload pictures to storage. When going over the blob documentation, I realized that all blobs are publicly accessible.

The options param has a required access field, which can only be set to public. Is there a plan to extend this to have a private alternative?

[vvo]

Hey @sakarisson, yes! We do have plans to have private blobs.

Here's the RFC we're sharing with interested customers, please give us feedback on it based on your usecase as "private" means different patterns for customers, thanks!

Private_Blobs_RFC_for_customer_feedback.pdf

[NotNoshy]

I like the Edge Middleware Authorization. It seems convenient for most use cases. Plus it works on Edge functions which is nice. For accessing Blobs on the server it seems a little less convenient but still reasonable (the proposed solution seems pretty easy to wrap in a function).

I don't love Temporary URLs because it feels like it could have edge cases or be misconfigured. It probably isn't a big deal - but the timeout is something everyone will have to think about before using it. I can think of cases where it would be the most useful (temporary downloads).

For my use case I do need to access blobs from the client and rarely from the server (which probably isn't that common, but I do it).

[theianzhang]

Hey @vvo thanks for sticking with this! Confirming use case #2, blob token auth, would meet my application's needs. For audit trail and compliance reasons (no ACLs), signed URLs introduce a slight business risk.

[moshmage]

Hey @sakarisson, yes! We do have plans to have private blobs.

Here's the RFC we're sharing with interested customers, please give us feedback on it based on your usecase as "private" means different patterns for customers, thanks!

Private_Blobs_RFC_for_customer_feedback.pdf

any ETA on createPrivateBlobUrl() ?

[phyziyx]

Hi,

I've several features on the wishlist:

• ability to specify the max file size per upload with pre signed URL (preventing users from uploading files larger than they are permitted)
• private blobs
• more metadata on the file upload lifecycle function (such as content type etc) - not sure if this is something I can receive using the HEAD function
• custom metadata for files

[JulianJorgensen]

Hey guys, do you have a status for this? Would LOVE this feature as I'm working with sensitive json data that I simply can't have public.
Cheers

[snkashis]

whats the ETA on this?

[mrestrepoj10]

Hello everyone,
I wanted to check if there are any updates or plans regarding this topic.
Thank you!

[FlyingGrasss]

Man I wish this existed, but I guess we have to stick with the addRandomSuffix for now. it is practically impossible to guess the url but if there was a leak the files would still be unsafe.

[sudo-vaibhav]

any progress?

[victor9000]

It is completely absurd that there’s no way to store a blob so only the uploading identity can access it. I guess I'm off to store my couch on the sidewalk, but first I need to get my shoes from the next street over.

[red2678]

I am just getting here too.....

What, ugh?! I cannot make them private?? :/