Support for temporary upload URLs (S3)

[mzur]

The S3 filesystem adapter already supports presigned URLs for downloading files through the temporaryUrl method. I would like to propose an extension of this adapter to also support presigned URLs for file uploads. This could be very useful for large file uploads where uploading to the web server, passing the file on to the application and then uploading the file to the storage disk (e.g. S3) could easily run into the script execution timeout. Alternatives such as chunked uploads are quite complicated and a direct file upload to S3 through a presigned URL could be an easy alternative.

The change would be quite simple:

diff --git a/src/Illuminate/Filesystem/AwsS3V3Adapter.php b/src/Illuminate/Filesystem/AwsS3V3Adapter.php
index 45d4f54536..1ac6191d45 100644
--- a/src/Illuminate/Filesystem/AwsS3V3Adapter.php
+++ b/src/Illuminate/Filesystem/AwsS3V3Adapter.php
@@ -63,7 +63,8 @@ public function url($path)
      */
     public function temporaryUrl($path, $expiration, array $options = [])
     {
-        $command = $this->client->getCommand('GetObject', array_merge([
+        $commandName = $options['s3Command'] ?? 'GetObject';
+        $command = $this->client->getCommand($commandName, array_merge([
             'Bucket' => $this->config['bucket'],
             'Key' => $this->prefixer->prefixPath($path),
         ], $options));

Users can then use the following code to generate a presigned URL for file uploads:

$url = Storage::temporaryUrl('file.jpg', now()->addMinutes(5), [
   's3Command' => 'PutObject',
]);

[mzur]

Ok, I'm withdrawing my proposal because I realized the following issues with this approach:

1. You can't do any file size validation if the application is bypassed for the upload. Basically the one getting the URL can upload as much data as they want.
2. The upload link does not expire when it should. Imagine the client notifying the application once the file upload is finished and the application moves on to process the file (e.g. move it elsewhere). As long as the temporary URL is valid, the client can upload a new file without the application knowing.

So it's probably a bad idea to support this practice.

[aneeskhan47]

@mzur FYI. it's now in Laravel 9.52 and Laravel 10: https://laravel.com/docs/10.x/filesystem#temporary-upload-urls

[mzur]

Thanks for the notice!