PUT signed URL include mimetype and content length for improved security?

[alexcroox]

I'm looking to replace the S3 SDKs with this library and one item I can't work out from the examples is how to make content length and mime type part of the signing request so the client cannot upload a huge file to the key, or a malicious mime type.

Here is my current S3 SDK signing request I'm looking to replace:

  return await getSignedUrl(
    client,
    new PutObjectCommand({ Bucket: media.bucket, Key: key, ContentType: mimeType }),
    {
      expiresIn: expiresSeconds
    }
  )

What I have so far:

const endpoint = new URL(key, `https://${media.bucket}.${media.accountId}.r2.cloudflarestorage.com`)

endpoint.searchParams.set('X-Amz-Expires', expiresSeconds.toString())

const { url } = await client.sign(endpoint, {
  method: 'PUT',
  aws: { signQuery: true }
})

Thanks!