Expire Tenant Signed Downloads
Set issue, use, expiry, and revocation rules for signed tenant file links, then verify them at storage and edge.
A signed download link is a capability: whoever holds it may be able to fetch the file until it expires. A user can copy it before losing tenant access. Ending a session does not necessarily revoke that link. Treat link issuance and link use as two separate decisions. OWASP Authorization gives the resource-level rule; the product must choose how long the capability remains valid.
Link lifecycle table
| State | Decision to record |
|---|---|
| Issue | Which authenticated user may request a link for this file? |
| Scope | Does the link name exactly one object and operation? |
| Use | Does storage check signature, path, and expiry? |
| Membership change | Must an already issued link stop working? |
| Expiry | Is the file or link inaccessible at edge and origin? |
| Incident | Can the owner retire links or the signing key? |
Choose an expiry that fits the file's sensitivity and delivery method. No single duration fits every file and delivery path. If immediate revocation is required, a self-contained URL may not be enough; use a server lookup or a storage mechanism that can deny a specific token. Record which behavior the system actually supports rather than promising a revoke button that cannot invalidate copied URLs.
In staging, create two synthetic tenant files. Ask for a link as an authorized A user. Confirm it reads only A's file. Try the same request as B, then use a tampered object path and an expired link in the owned test. Remove A's membership and check the documented post-removal rule. Keep live signed URLs out of logs and shared test records.
Verify expiry at each layer
Record four synthetic observations for one copied link: origin before expiry, CDN before expiry, origin after expiry, and CDN after expiry. Capture status and whether file bytes were returned, without recording the full URL. If the CDN still serves bytes after the origin rejects the expired link, the edge policy is a separate defect. Repeat after membership removal and label the result as the product's observed delegated-link behavior, not automatic revocation.
The OWASP Multi Tenant Security Cheat Sheet addresses shared resource boundaries. This lifecycle table makes the storage capability visible alongside those boundaries. If a download must remain available to an outside recipient, define that as a separate share feature with its own permission and retention terms. A signed URL is not a substitute for deciding who may receive the file.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.