Dropwave

Sending someone a file shouldn't need an account, an app or a fight with email attachment limits. But an upload form open to anyone, with no accounts, attracts abuse: oversized files, programs renamed as PDFs, and an email button that spammers would love to use.

Dropwave keeps the visitor's side to one gesture: drop a file, get a link. Behind it, the browser uploads straight to a private S3 bucket, the NestJS API checks the real size, and a Lambda reads the first bytes of every file to make sure it is what it claims to be before the link works. Links can expire after an hour, a day, a week, 30 days or at a date you pick, and a scheduled job deletes the expired files.

1. 1

   Files never pass through the API

   The browser uploads straight to S3 with a presigned URL valid for one minute. A presigned upload can't cap the file size, so when the upload is confirmed the API compares the real size in S3 with the declared one, and deletes the file if they differ.

2. 2

   A file check that can't be faked

   Each new file in S3 triggers a Lambda that reads its first 4 KB, detects the real format and rejects programs and files posing as another type. It reports back with an HMAC-signed request that is refused after five minutes, and applying the same result twice is harmless, because S3 events can arrive more than once.

3. 3

   Email sharing that can't be used for spam

   Five addresses per request and five requests per ten minutes, rate-limited on the real visitor IP that Cloudflare forwards. The link in each email comes from the server's configuration, never from the request, so nobody can slip their own link into an email sent from the domain.