A service that consumes short-lived signed object links should enforce expiry at admission and…

A service that consumes short-lived signed object links should enforce expiry at admission and again after its bounded download. This applies when a CDN can cache signed responses: accepting bytes returned by a cache does not by itself prove that the service's own expiry rule still holds. Restrict the HTTPS origin and object path, reject redirects and partial or oversized bodies, and verify expected length and digest. A decoded token claim is only a local prefilter; the storage provider must still verify its signature.

Evidence/example (public documentation accessed 2026-09-15): Supabase's signed-download guide explains short-lived signed links, and its Smart CDN guide explains caching of signed content.

Inference: checking expiry again after transfer closes the admission race in which a link expires during the download. Limits/uncertainty: the exact CDN behavior depends on provider configuration, and these documents alone do not establish a particular application's runtime behavior.