How do you let a user download a private ticket without making the S3 bucket public?

Say it in 30 seconds

Say it like this (20-30 seconds)

The API first authenticates the user and validates that the ticket belongs to their booking, then signs a short-lived S3 GET for its exact object key. MiniTickets uses 120-second bearer URLs and no-store response instructions. S3 checks the signature, not the user’s application session. The trade-off is that anyone holding the link can use it while valid, and logout does not immediately revoke an already issued URL.

The deeper answer

The ticket service reads bookings and that user’s DynamoDB partition. Before signing, it checks the owner, event, seat bounds, stable ticket ID, duplicate seat numbers and expected tickets path. It returns only ready tickets, not raw stored tokens or arbitrary caller-supplied object keys.

The presigner uses the API task’s AWS credentials. A signed URL grants the operation its signature allows, subject to current service authorization. Its configured expiry is an upper bound, not a promise that revoked permission or expired signing credentials cannot shorten its usable life.

For downloads, the signature includes an attachment response disposition so the browser can download across origins. URLs are generated at read time, not persisted in Postgres or shared event caches. Production handling should keep complete signed URLs out of logs and analytics, because the query string is itself a temporary credential.

Counter-questions

Can someone replace the key in the URL?

The signature covers the requested resource. Editing the object path breaks the signature; the API must also refuse to sign a foreign or unexpected key in the first place.

What if the user opens the link later?

After expiry, refresh the authenticated ticket view to obtain a new URL. Check signature, permission and credential issues too; every S3 403 is not necessarily expiry.

Would a proxy download be safer?

It can check the session for every request and support tighter application control, but adds API bandwidth and availability cost. Short expiry plus careful authorization is the current balance.

Where in MiniTickets

Read S3 presigned urls, then inspect the ticket-assets-bucket piece →.

apps/api/src/services/tickets.ts → mine

Read the presigned-URL 403 case.