File Upload Permissions Scoped to User

File uploads stored in a flat global namespace allow users to access, overwrite, or enumerate other users' files by manipulating the path or key. If the storage path is constructed from user-supplied input rather than the server-side session, path traversal (CWE-22) becomes possible. At minimum, a flat namespace lets user A's upload silently overwrite user B's file if both upload the same filename. OWASP A01 (Broken Access Control) covers this: storage access must be scoped to the authenticated user. NIST 800-53 AC-3 requires access enforcement before any resource operation, including writes to object storage.

Construct the storage path server-side from the authenticated session. Never accept a path from user input. Use the user's ID as a namespace prefix so each user's uploads are isolated.

// app/api/upload/route.ts
export async function POST(req: NextRequest) {
  const session = await auth();
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

  const file = await req.blob();
  // Path built from session — user cannot influence the namespace
  const filename = `users/${session.user.id}/${Date.now()}-${crypto.randomUUID()}`;

  const blob = await put(filename, file, { access: 'private' });
  return NextResponse.json({ url: blob.url });
}

Also ensure file reads use signed URLs scoped to the requesting user — do not generate public, persistent URLs for private uploads.