@backblaze-labs/b2-sdk - v0.2.0
    Preparing search index...

    Interface PresignS3GetObjectUrlOptions

    Options for presignS3GetObjectUrl.

    interface PresignS3GetObjectUrlOptions {
        accountInfo: AccountInfo;
        allowBrowserExecutableResponseContentType?: TrustedUnsafeS3PresignOptIn;
        allowInlineResponseContentDisposition?: TrustedUnsafeS3PresignOptIn;
        applicationKey: string;
        applicationKeyId: string;
        bucketName: string;
        expiresIn?: number;
        fileName: string;
        region?: string;
        responseCacheControl?: string;
        responseContentDisposition?: string;
        responseContentEncoding?: string;
        responseContentLanguage?: string;
        responseContentType?: string;
        responseExpires?: Date;
        versionId?: string;
    }

    Hierarchy (View Summary)

    Index

    Properties

    accountInfo allowBrowserExecutableResponseContentType? allowInlineResponseContentDisposition? applicationKey applicationKeyId bucketName expiresIn? fileName region? responseCacheControl? responseContentDisposition? responseContentEncoding? responseContentLanguage? responseContentType? responseExpires? versionId?

    Properties

    accountInfo: AccountInfo

    The authorized AccountInfo containing the S3 endpoint URL.

    allowBrowserExecutableResponseContentType?: TrustedUnsafeS3PresignOptIn

    Permit browser-executable responseContentType overrides such as text/html, JavaScript, SVG, or XML media types. Leave this unset unless the served object is intentionally meant to render active content from the storage origin. Pass trustedUnsafeS3PresignOptIn; plain booleans from request JSON are intentionally ignored by the runtime guard.

    allowInlineResponseContentDisposition?: TrustedUnsafeS3PresignOptIn

    Permit an inline response Content-Disposition override. Set only when the object bytes and response headers are trusted to render from the storage origin. Pass trustedUnsafeS3PresignOptIn; plain booleans from request JSON are intentionally ignored by the runtime guard.

    applicationKey: string

    B2 application key (secret). Used as the S3 secretAccessKey.

    applicationKeyId: string

    B2 application key ID. Used as the S3 accessKeyId.

    bucketName: string

    Bucket containing the object.

    expiresIn?: number

    URL validity duration in seconds. Defaults to 3600. Must be an integer from 1 to 604800 (7 days), the AWS Signature Version 4 presign maximum. A presigned URL is a bearer credential for the signed operation; keep this as short as the calling workflow allows.

    fileName: string

    Object key / B2 file name to sign. Keys with path segments exactly . or .. cannot be presigned safely because common URL parsers normalize them before sending the request.

    region?: string

    Override the S3 region. If omitted, extracted from the S3 API URL.

    responseCacheControl?: string

    Override the response Cache-Control header. Response overrides control headers served from the storage origin; do not populate them from untrusted input without an allow-list.

    responseContentDisposition?: string

    Override the response Content-Disposition header. Prefer a safe attachment disposition when this value can be influenced by users. The helper rejects inline response dispositions by default because they can make stored bytes render from the storage origin.

    responseContentEncoding?: string

    Override the response Content-Encoding header. Do not populate this from untrusted input without an allow-list.

    responseContentLanguage?: string

    Override the response Content-Language header. Do not populate this from untrusted input without an allow-list.

    responseContentType?: string

    Override the response Content-Type header. If attacker-controlled, this can make stored bytes render as active content from the storage origin. Restrict it to known-safe values before signing. The helper's built-in rejection of known browser-executable and sniffable XML/JavaScript media types is best-effort and does not replace an application allow-list.

    responseExpires?: Date

    Override the response Expires header. Do not populate this from untrusted input without an allow-list.

    versionId?: string

    Optional S3 version ID to include in the signed GET request.

    Settings

    Member Visibility

    On This Page

    Properties