What Is a Presigned URL? How Direct-to-Object-Storage Transfers Work
How Attach & Send moves multi-gigabyte files directly between the browser and private DigitalOcean Spaces while enforcing strict server-side verification.
Why files should not pass through the Node.js API process
Streaming 50GB uploads through an application server ties up CPU, memory, and double-bills network bandwidth. Instead, the API authenticates the request, reserves quota in MySQL, and signs a short-lived AWS SigV4 PUT URL for specific multipart part numbers.
Crucially, the browser finishing an upload never makes a file public. The server independently performs a HEAD check, verifies the byte size, and runs an isolated ClamAV scan before issuing a share token.
Short-lived signed GET URLs for recipient downloads
When a recipient clicks Download, they never receive a permanent public bucket URL. First, the API verifies link expiration, password unlock proof, scan status, and outbound byte quota.
Only after those checks succeed does the API mint a 90-second presigned GET URL with a forced 'Content-Disposition: attachment' header so the browser downloads the file safely without executing inline HTML or SVG.
Try Attach & Send free
Upload up to 2 GB with password protection and 3-day link expiry — no account needed.