Private media delivery

CDN & Private Media Delivery

Delivering media and files fast without leaking private tenant data requires aligning storage keys, Cache-Control headers, CDN signing and application share-link tokens with the file's exact access model.

1. Classify Assets by Access Model First

Never put private user uploads in a public bucket "just to make CDN caching easier":

1. Truly Public Assets (marketing images, public product catalog photos, public avatars where policy explicitly states they are world-readable):
   • Serve via CDN with immutable content-addressed or versioned keys (avatars/{id}.{hash}.webp) and Cache-Control: public, max-age=31536000, immutable.
2. Authenticated Tenant / User Files (project attachments, private media, invoices, exports):
   • Bucket remains 100% private.
   • Authorize every access request in application code first, then deliver via one of two patterns:
     • Short-lived CDN / Object-Store Signed URL (CloudFront Signed URL, Cloudflare R2/Workers signed token, S3 Presigned GET, GCS/Azure SAS) with a short TTL (60–900 seconds).
     • Signed Cookies scoped to a path prefix (e.g., CloudFront Signed Cookies scoped to tenants/{tenant_id}/videos/{video_id}/*): essential for HLS/DASH video streaming, where a video player requests hundreds of .m3u8 and .ts/.m4s segment URLs and signing every segment URL individually in the manifest is brittle.
3. Revocable External Share Links (/s/{share_token}):
   • Do not hand out a 7-day S3 presigned URL directly as a user-facing "Share Link" if the product allows revoking share links, password-protecting links or tracking download counts!
   • Instead, issue an application share URL (/s/{high_entropy_token}) backed by a file_shares table (id, file_id, token_hash, expires_at, revoked_at, max_downloads, download_count, password_hash).
   • When a visitor hits /s/{token}, validate that the share is not revoked/expired and the parent file is not deleted, then redirect (302 with Cache-Control: private, no-store) to a 60-second signed storage URL.

2. Cache-Control & Vary Discipline

• Authorization-check endpoints (/api/files/{id}/download, /s/{token}): must always return Cache-Control: private, no-store so shared proxies or CDNs never cache User A's redirect for User B.
• Signed immutable derivative objects: once authorized via a signed CDN URL, the underlying immutable derivative (thumb_256_v1.webp) can be cached at the CDN edge (s-maxage) while requiring a valid signature on every edge request.
• Range & CORS headers on CDN: forward Range / Origin headers when serving video/audio or canvas/WebGL textures across origins, and include Vary: Origin, Range so partial byte responses are cached properly.
• Never log signed URLs or share tokens in plaintext access logs or analytics beacons (Referer header leakage — set Referrer-Policy: no-referrer on download/share pages).