storage-url-safety

Guides URL strategy selection for MinIO, OSS, and S3 object storage.

1.0k|109|Updated Jan 4, 2026
One-click install
npx skills add https://github.com/doccker/cc-use-exp --skill storage-url-safety
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: storage-url-safety
Source: https://github.com/doccker/cc-use-exp/tree/main/.claude/skills/storage-url-safety
Command: npx skills add https://github.com/doccker/cc-use-exp --skill storage-url-safety

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Object storage URLs often break in production: avatars expire because they use presigned URLs limited to 7 days, public URLs return 403 because the bucket lacks a public-read policy, and upload endpoints accept any file without validation. This Skill prevents these failures by enforcing correct URL strategy selection.

Core Features & Use Cases

  • URL Strategy Selection: Decision table mapping resource types (avatars, product images, private documents, upload credentials) to public URL, CDN, or presigned URL with appropriate expiry windows.
  • Common Pitfall Detection: Covers six recurring traps including expired presigned URLs on long-lived assets, missing bucket public-read policies, misconfigured CDN origin settings, and duplicated URL-resolution logic scattered across services.
  • Secure Upload Validation: Enforces file type and size checks plus UUID-based filenames when issuing presigned upload credentials for direct client uploads.
  • Use Case: When building a file upload feature with MinIO, the Skill ensures avatars use public or CDN URLs, temporary exports use presigned URLs with 1-24 hour expiry, and a shared ImageUrlResolver utility centralizes response-layer URL completion.

Quick Start

Ask the AI to review your file upload and download code for object storage URL strategy issues before deploying.

Frequently Asked Questions about storage-url-safety

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose between presigned URL and public URL for MinIO?

Use public URLs or CDN URLs for long-lived resources like avatars and product images, and presigned URLs for temporary or private files. Presigned URLs expire after a maximum of 7 days, so they cannot serve permanent assets.

Why does my MinIO public URL return 403 Forbidden?

The bucket lacks a public-read policy even though the URL format is correct. Configure anonymous download access with mc anonymous set download, attach a bucket policy allowing s3:GetObject, or set the OSS bucket ACL to public-read.

What expiry time should presigned URLs use for file uploads?

Client direct-upload credentials should expire in 5-30 minutes, temporary share links in 1-24 hours, export downloads in 1-7 days, and private document views in 15-60 minutes. Match expiry to the actual usage window to balance security and usability.

How do I secure frontend direct uploads to OSS or S3?

Validate the file content type against an allowlist and enforce a size limit on the backend before issuing the presigned upload URL. Generate filenames with UUIDs to prevent path traversal attacks.

Why do images break after CDN integration with MinIO?

CDN origin configuration is usually wrong: the origin Host must match the MinIO endpoint, the protocol must be HTTP, and the origin path must include the bucket name. Misconfiguration causes CDN responses of 404 or 403.

Does this apply to cloud providers other than MinIO?

Yes, the same URL strategy rules apply to Aliyun OSS, Tencent COS, AWS S3, Qiniu Kodo, and Huawei OBS. All share the presigned URL expiry limits and bucket policy requirements.