AWS S3 Storage (Java)

To generate pre-signed URLs for secure S3 browser uploads in Java, configure an S3Presigner singleton and create a pre-signed PUT URL. You must apply server-side MIME allowlisting before signing to prevent malicious file uploads.

You should store only the S3 object key, such as uploads/uuid.ext, in your database. This key-first storage strategy enables bucket or CDN changes later without requiring data migrations, generating signed URLs on demand.

To validate a file was uploaded to S3, implement a post-upload confirmation endpoint that checks object existence using a HeadObjectRequest. Only after confirming the object exists in S3 should you persist the object key to your database.

You can unit test Java S3 pre-signed URL logic by mocking the S3Client and S3Presigner instances using Mockito. This approach avoids real S3 calls while validating your MIME allowlisting and key generation logic.

Yes, this S3 pre-signed URL approach works with production Spring backend APIs. It requires S3Client and S3Presigner singleton configuration sourced from environment variables or IAM roles to manage secure uploads and downloads.

The best way to prevent malicious file uploads with pre-signed S3 URLs is enforcing server-side MIME allowlisting before signing. This validation ensures only approved file types are accepted for direct browser uploads.