What would bother you about exposing the bucket? There's no immediate security hole, but I'd still be wary about exposing the bucket name, directory name and o

What would bother you about exposing the bucket? There's no immediate security hole, but I'd still be wary about exposing the bucket name, directory name and object name unnecessarily. Those might have a direct correspondence with the original public URL, but they might not. Maybe the object name is a database ID and the same ID gets used elsewhere for some other purpose. Who knows? Why take the chance if you don't need to? I'd prefer an API like this where it's explicit That's the thing, in the previous section it already described the "s3.presign()" function. If you want to redirect to a presigned URL, you already have everything you need, no magic required.