Vercel Blob begins supporting Signed URL feature

Vercel Blob now enables the creation of Signed URLs that grant limited permissions for specific objects. These URLs can have a specific operation (put, get, head, delete), a single path, and an expiration time of up to 7 days configured, allowing safe file management without exposing access to the entire store.

The key features are as follows:

• Operation-specific permission restriction: Each URL is limited to a single operation. For example, a URL signed for GET cannot be reused for a PUT operation.
• Large file handling: put operations support multipart, allowing the browser to stream files directly to Blob storage without going through the server.
• Conditional deletion: The ifMatch option allows deletion to be performed only if the object has not changed since the signing time.

This feature works together with OIDC authentication. By having the server authenticate to Blob via OIDC and generate signed tokens, the risk of long-lived BLOB_READ_WRITE_TOKEN leaking outside the server is prevented. Users can update the @vercel/blob package to version 2.4.0 to use this feature.