Didn't someone with another username ask this exact question here 2 hours ago? Its even the same file name.. Just this time with r2.dev not a custom domain.
(Unauthorized) error: Service Error Message.; XML Error Message: <?xml version="1.0" encoding="UTF-8"?><Error><Code>Unauthorized</Code><Message>SigV2 authorization is not supported. Please use SigV4
In S3 there is a conditions field which can limit what kind of files (size, content type, etc.) can be uploaded. I don't know if R2 supports this, the documentation says nothing about it.
You can presign the Content-Type header, but clients can just lie about what they’re uploading. If you need real content validation you need to do it on your server either before or after the upload
It depends on the uploaded file size. You could create an upload endpoint on your server and after checking the file upload it from your server to R2. For small files like images thats a way, but will get impractical for large files. But all in all you should make a risk assessment what a malicious user achieve when manipulating the upload.
Oh and one other solution I've implemented once in a Nextjs app with large files: Create an API endpoint where users upload file chunks to and keep track of the progress. Once all chunks where received (and forwarded to R2) I've known that the file upload was complete and I could send out a message to process the file.
Hello. I've noticed an unexpected behaviour when creating R2 API Keys. Seems that API keys are bounded to each profile (user account) but not to the organization account?
This is an issue in case a developer that has created API keys leaves the company then we will lose immediate access to R2. Does someone know how to create an account wide API key?