Presigned Uploads Need a Server-Side Completion Check

The Presigned Upload Architecture

Modern web applications frequently delegate file handling directly to cloud storage providers using presigned URLs. This pattern reduces application server load and network bandwidth by allowing the client to send large payloads straight to a storage bucket. The application requests a time-limited, signed URL from the storage API, passes it to the client, and the client performs the upload via a standard HTTP PUT or POST request.

While highly scalable, this architecture inherently bypasses the application server during the actual data transfer phase. Consequently, traditional application-tier validation steps, such as those recommended by the OWASP File Upload Cheat Sheet, are skipped unless explicitly reintroduced. Relying purely on the storage bucket's configuration or client-side checks creates a dangerous blind spot in the application's security posture.

The Missing Link: Server-Side Completion Verification

According to the OWASP File Upload Cheat Sheet, developers must not trust the Content-Type header provided by the user, as it is trivial to spoof. When a client uploads directly to a storage bucket, they can manipulate the Content-Type, file extension, and internal content. If the application blindly assumes that a successful storage PUT means the file is safe and valid, it inherits significant risk.

To mitigate this, the architecture must include a server-side completion check. After the client completes the presigned upload, it must notify the application backend. The application then retrieves the file from a quarantine area in the storage bucket, performs rigorous backend validation, and only then promotes the file to a permanent, accessible location.

Concrete Worked Example

Consider a hypothetical profile picture upload system. The client requests an upload token. The application generates a UUID for the file, ensuring a safe filename, and generates a presigned URL scoped only to the storage prefix 'quarantine/'.

The client uploads the file to the presigned URL. Upon success, the client sends a completion API request to the application server with the UUID. The application backend then fetches the object from the quarantine prefix.

The backend reads the first few bytes to perform file signature validation, commonly called magic byte checking. If the signature matches a valid image format like PNG or JPEG, and the file size is within limits, the backend issues a storage copy command to move the object to the 'active-profiles/' prefix and deletes the quarantined original. Finally, the application updates the database record to associate the image UUID with the user.

Safe Test Matrix: Allowed and Denied Outcomes

When implementing this completion check, a rigorous test matrix is required to ensure validation logic holds under various conditions. The following hypothetical matrix outlines the expected outcomes for different upload scenarios.

Scenario 1: A file with a .png extension, an image/png content type, and valid PNG magic bytes. Expected outcome: Allowed. The file is promoted to the active directory.

Scenario 2: A file with a .png extension, an image/png content type, but containing PHP script content and lacking image magic bytes. Expected outcome: Denied. The application detects the signature mismatch during the completion check, deletes the quarantined file, and returns an error.

Scenario 3: A file with a .jpg extension, but the size exceeds the configured 5MB application limit during the read stream. Expected outcome: Denied. The file is purged from quarantine.

Scenario 4: A client uploads a valid image to quarantine but never sends the completion API request. Expected outcome: Denied/Purged. A storage lifecycle rule automatically deletes objects in the quarantine prefix after 24 hours.

Implementation Tradeoffs and Failure Modes

Implementing a quarantine-and-promote pattern introduces latency. The completion API call requires the application backend to perform a storage read, process the file in memory or on disk, and perform a storage copy operation. For very large files like video uploads, full file content validation might exhaust backend memory or trigger timeout limits.

A common failure mode occurs when developers only validate the metadata returned by the storage API rather than inspecting the actual file content. Storage APIs often return the exact Content-Type the client supplied during the PUT request. Relying on this metadata defeats the purpose of the completion check. Another failure mode is failing to implement automated cleanup for the quarantine bucket, leading to unbounded storage cost growth from abandoned partial uploads.

Evidence Limits and Threat Mitigation

The OWASP File Upload Cheat Sheet emphasizes that there is no silver bullet in validating user content and that defense in depth is required. Validating file extensions and magic bytes stops trivial bypasses but does not guarantee the file is free of malicious payloads like polyglot images or exploiting vulnerabilities in image parsing libraries. Rewriting images does not guarantee all malicious content is removed.

To further mitigate threats, store files on a different host or outside the webroot, as OWASP advises. Ensure that files are served with headers that force the browser to treat them as downloads or strictly as their intended media type, mitigating stored cross-site scripting risks if a malicious file bypasses the completion check.

Sources and References

The file upload security principles, including the warning against trusting user-provided Content-Type headers, the necessity of file signature validation, and safe storage location practices are sourced directly from the OWASP File Upload Cheat Sheet. Retrieved on 2026-11-12 from: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results.

Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results.

• Primary reference: cheatsheetseries.owasp.org