Presigned File Upload to Object Storage

Design a presigned upload so the file goes from the browser to object storage without passing through my server, and a malicious client cannot overwrite someone else's object. CONSTRAINTS Storage: [S3 | R2 | GCS] Max size: [MB] Allowed types: [LIST] Who can upload: [AUTHENTICATED USER] Object key shape: [TENANT / USER / UUID / FILENAME] Public or private: [WHICH] Virus scan or dimension check after upload: [YES | NO] DELIVER 1) The API that returns the presigned URL: auth check, content-type allow list, content-length condition, expiry in minutes, and the key generated on the server. The client does not choose the key. 2) The browser call, including the headers that must match the signature. 3) How we record the object only after a confirmation request, so abandoned uploads do not become database rows. Include a cleanup for orphans. 4) The failure cases: wrong content-type, oversized file, expired URL, replay of a URL. 5) The bucket policy idea: no public list, private by default, downloads via a second presign or a CDN with auth. Do not embed the storage secret in the client. Do not use the original filename as the only key.