Building a TypeScript SDK for Secure Direct Uploads to AWS S3 and ImageKit

Introduction

Handling file uploads in web applications often involves a trade-off between security, performance, and developer experience. A new open-source TypeScript SDK, Upload SDK, addresses these concerns by enabling secure direct uploads from the browser to cloud storage providers such as AWS S3 and ImageKit.

How It Works

The SDK shifts the responsibility of file transfer away from the application server. The workflow is as follows:

1. The Node.js server validates the upload request.
2. The server generates a short-lived, signed upload target.
3. The browser uploads the file directly to the storage provider using the signed details.

This approach ensures that the application server never needs to stream or proxy the actual file data, reducing bandwidth usage and server load.

Configuration and Usage

Developers define named upload types (e.g., avatar, invoice) to manage different file categories. Each type includes configuration rules:

• Allowed MIME types and file extensions
• Maximum file size
• Expiry time for the upload request
• Storage destination and key prefix

To initiate an upload, the browser sends the asset name and file metadata to the server. The server then calls prepareUpload(), which validates the request, generates a collision-resistant storage key, and returns signed multipart POST details to the client.

Multiple Storage Profiles

The SDK supports multiple storage profiles within the same application. For instance, developers can configure:

• One S3 bucket for public files
• Another S3 bucket for private documents
• ImageKit for image-specific storage

This configuration maintains a consistent upload flow across different providers.

Security with Signed Policies

For Amazon S3, the SDK includes security constraints directly in the signed POST policy. This policy can enforce:

• File size limits
• Content type validation
• Specific storage keys
• Expiration times

These restrictions are enforced by S3 during the upload process, adding an additional layer of security.

Next Steps

The project is open for feedback on its current API and for suggestions regarding which storage providers to support next.