This repository has been archived by the owner on Mar 21, 2019. It is now read-only.
Upload endpoints should be one-off. #367
Assignees
Labels
Comments
rjw57
added a commit
that referenced
this issue
Nov 19, 2018
JWP media upload endpoints are one-use-only URLs. Unfortunately we
allowed the same URL to be retrieved multiple times from the upload
endpoint which meant that a client may try to upload a media item
multiple times to the same URL.
Fix this by making the /media/{id}/upload endpoint a PUT-only endpoint.
If the upload endpoint URL exists in the database to begin with, we
return it and delete it from the database. If the endpoint does not
exist, we create one first.
This involves a bit of an unnecessary write and then delete from the
database in the case where the endpoint does not exist but for the
common case of "create media item" then "get upload endpoint", it Does
The Right Thing (TM).
Closes #367
rjw57
added a commit
that referenced
this issue
Nov 19, 2018
JWP media upload endpoints are one-use-only URLs. Unfortunately we
allowed the same URL to be retrieved multiple times from the upload
endpoint which meant that a client may try to upload a media item
multiple times to the same URL.
Fix this by making the /media/{id}/upload endpoint a PUT-only endpoint.
If the upload endpoint URL exists in the database to begin with, we
return it and delete it from the database. If the endpoint does not
exist, we create one first.
This involves a bit of an unnecessary write and then delete from the
database in the case where the endpoint does not exist but for the
common case of "create media item" then "get upload endpoint", it Does
The Right Thing (TM).
Closes #367
jbrownrs
pushed a commit
to jbrownrs/issue-376-GDS-link
that referenced
this issue
May 26, 2020
JWP media upload endpoints are one-use-only URLs. Unfortunately we
allowed the same URL to be retrieved multiple times from the upload
endpoint which meant that a client may try to upload a media item
multiple times to the same URL.
Fix this by making the /media/{id}/upload endpoint a PUT-only endpoint.
If the upload endpoint URL exists in the database to begin with, we
return it and delete it from the database. If the endpoint does not
exist, we create one first.
This involves a bit of an unnecessary write and then delete from the
database in the case where the endpoint does not exist but for the
common case of "create media item" then "get upload endpoint", it Does
The Right Thing (TM).
Closes uisautomation#367
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Upload endpoints are single use and we don't know when a user uses them so make sure that a given endpoint is only returned once from the API. The upload API endpoint should be POST-only. POST-ing to it returns the upload endpoint if one exists or creates and returns one if one doesn't. If an UploadEndpoint exists and the POST returns immediately, it should delete the UploadEndpoint. If an UploadEndpoint does not exist, the POST view should create an ephemeral one which is returned but not persisted to the DB.
UploadEndpoints should not be retrieved for videos whose status is anything other than "created". If the video has a different status, the endpoint should return an error response that indicates that a video has already been uploaded.
The idea is that we get an UploadEndpoint creation "for free" when we create the media item at the moment. We want the common case the an API user creates a media item and then retrieves the upload endpoint to be cheap requiring only one JWP management API call but we want to support re-tries for uploading the video.
The text was updated successfully, but these errors were encountered: