OThanks
D'#' is a special character for URLs (fragment identifier), so I suspect it has something to do with that. In a normal HTTP request, anything after the # is not sent as part of the underlying HTTP request. That being said, it does look like it's possibly a bug in R2. If I have a filename of
A user could probably upload a carefullly crafted filename to overwrite other filenames. Although if you are allowing users to upload direct to R2 with filenames they choose, they could probably overwrite other files anyway.
If it's user generated content, you really don't want to be uploading them to R2 willy-nilly with the filename users uploaded it as anyway.
somefile#123.jpg and I upload it via R2 dashboard, it shows as being uploaded as somefile, but accessing it via a URL encoded string (needed since anything after # isn't sent to the server by the browser). So the R2 upload process drops anything after the # (same as a browser would do making the request for it). At which point you would be left with an empty file.A user could probably upload a carefullly crafted filename to overwrite other filenames. Although if you are allowing users to upload direct to R2 with filenames they choose, they could probably overwrite other files anyway.
If it's user generated content, you really don't want to be uploading them to R2 willy-nilly with the filename users uploaded it as anyway.
DYep... I uploaded a file via the dashboard as a test... 
somefile#123.jpg ended up as somefile in the dashboard. I was too scared to try it with a file that started with # because I didn't want to end up an object that wasn't deletable. DSeems so... it's how browsers handle requests with
# in it, so it's not the only place in the world that works that way, but uploading to R2 isn't a normal browser request. Might be something like they are parsing the uploaded R2 object key as a URL path, and if it's a URL path, anything after # would be dropped. It does seem like a bug to me.DOr maybe you just need to URL encode object keys when uploading?
DBut even if you are supposed to that, the normal R2 dashboard isn't doing it, so... 
DYou might want to try URL encoding it... Looking at the underlying mechanism for uploading an object, the object key is part of the S3 endpoint... so underneath it all, you are sending the request to:
So I bet that's the culprit right there... the "filename" being part of the request. And anything after the
It might be as simple as URL encoding the filename.
PUT https://{account_id}.r2.cloudflarestorage.com/{bucketname}/{object_key}So I bet that's the culprit right there... the "filename" being part of the request. And anything after the
# isn't valid in an HTTP request.It might be as simple as URL encoding the filename.
D...if that's the case maybe it's just a bug in Cloudflare's dashboard and they need to be URL encoding it themselves too (and they are not).
DIt's not an "official" endpoint, but you can create buckets with Cloudflare API without using S3 API.
That can change at any time though, and doesn't solve your problem of improperly signed S3 requests. So uploading objects and other operations are going to also fail.
public function createR2Bucket($accountId, $bucketName)
{
$params = [
'name' => $bucketName,
];
return $this->makeRequest('POST', sprintf('accounts/%s/r2/buckets', $accountId), ['json' => $params]);
}That can change at any time though, and doesn't solve your problem of improperly signed S3 requests. So uploading objects and other operations are going to also fail.
DIf you mean an endpoint different than
https://{account_id}.r2.cloudflarestorage.com/{bucketname}/, no. The S3 API does not work on custom public domains for buckets (so for example you can't have a presigned URL within your own domain)DIf it works with S3, it should work with R2 (mostly)
DMaybe I'm missing something, but postman looks like it's just an abstraction layer on top of the S3 API. If I were you, I'd skip postman and just use the S3 API since that's what it's probably using underneath it all anyway.
MIs there any way to associate metadata with a file in R2? It looks like S3 "object tags aren't supported"
MUse case is being able to associate a set of files with a "project" and perform bulk actions on them later
OIf I write data from my worker to r2, will I get billed for the worker execution time while the file is being uploaded ?
Bi am uploading images and stuff to my storage. but is there a system that i can follow to delete the stored object if its related party is deleted on the mongodb? like i am uploading an image to r2 & then using the url for the image in the document as a header whoes object is stored in mongo. if that document is deleted in mongo, how do i delete the image in r2? like any guidance?
OMongodb offers change events that you can use to know when entities are deleted, then react upon deletion
OI would also suggest that you have cron jobs, every once in a while to delete unreferenced files
OYou could also use some queues that you trigger from your application when entities that references a file has been deleted/updated
KYou kind of want to structure it the other direction. You want the object in Mongo to be the “truth” or the record of having the file. When you want to delete the record you delete the Mongo object and the file in R2 as part of the same process. The Mongo object has a copy of the R2 key. You should not have any orphaned R2 files if you’re strict about this, and it will also make it so you don’t have to list your R2 files frequently.
PHi! is the URL signing operation class A or class B for purposes of billing?
PI'm going to use it to allow downloads only to those with the URL, would that work?
Pthat's perfect, it's exactly what I want. Thank you
BIf i want to create an application, where you can upload images and videos. Should i then use R2, or Stream and Images?
The videos dosen't have to be streamed, but i still need thumbnails (the first frame of the video).
The videos dosen't have to be streamed, but i still need thumbnails (the first frame of the video).
KR2 will be much cheaper than the other options, but it is just object storage - what you store is what users will get. No re-encoding, different qualities, etc.
KThumbnails would need to be created by yourself, i.e with ffmpeg
THello, I can't remove a custom domain from a bucket. It says "The specified bucket does not exist. (Code: 10006)", which seems incorrect, since I'm literally in that bucket's settings. I mistakenly added my app's subdomain there and thus made it inaccessible. Please help!
DWhile not a solution to being unable to delete it, Cloudflare really should prevent users from adding a public domain to an R2 bucket that already has a DNS entry. I’ve had multiple users accidentally put the root of their domain as their public domain for an R2 bucket which of course kills their site until they remove it and restore the DNS entry the action overwrote.
Tyes exactly ... I misread the description and thought it was for allowing requests from that domain 
killed my app and now I can't undo it
killed my app and now I can't undo it
IIs it possible to stream videos with R2? And if so, how would i go about doing that?
T@Cloudflare (Server Owner) can anybody help, please?
IPlease don't ping people directly.
ISomeone will help if they can, but pinging people doesn't get your question answered faster and in fact makes people less likely to help.
Tyou're right, sorry, I'm just panicking a little here
ZTo be fair, it does warn you before you confirm the action
THi, I also ran into this problem where I can't remove the domain from public access because it says 10006 error. What to do in this case?
DYa, it does show what it was and what it will become, however even with that I've ended up with 10-15 users overwriting DNS records on accident. I just think it would make more sense to force a user to delete the existing record first. That way they have to take a clear action vs. users just blindly clicking "okay". I wish users read more, but it's unfortunately not the case.
ZThat's true, like how if you want to remove the R2 bucket entry in the DNS you have to go to the R2 dashboard, the same could be done for that
DUsually it's users trying to connect the root of their domain, thinking it's somehow allowing access from their domain (like some sort of wildcard maybe?)
DI did end up plopping in a "suggested" subdomain by default for my UI and for the users that blindly click, it helped. However, I still think it would make sense to throw an API error if the public domain they choose already exists in their DNS.
