Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Don't cache or reuse URLs that carry an expiring access token
A fallback URL used as a long-lived cache key must not embed a short-lived token, or the cached result breaks once the token expires.
Bad example
| 1 | function getCacheableImageUrl(asset: Asset) { |
| 2 | // asset.previewUrl looks like: https://storage.example.com/img.png?accessToken=abc123 |
| 3 | return asset.previewUrl; |
| 4 | } |
Explanation (EN)
Reusing an expired credential URL breaks retrieval and can leak access through shared caches.
Objašnjenje (HR)
Ponovna uporaba isteklog credential URL-a prekida dohvat i može proširiti pristup preko zajedničkog cachea.
Good example
| 1 | const cacheKey = { assetId: asset.id, accessScope: session.cacheScope }; |
| 2 | const fetchUrl = await resolveAuthorizedAssetUrl(asset.id, session); |
Explanation (EN)
The cache identity is stable and authorization-scoped; fetching still uses a valid credential rather than an unauthenticated stripped URL.
Objašnjenje (HR)
Cache identitet je stabilan i vezan uz autorizacijski opseg. Dohvat i dalje koristi valjanu vjerodajnicu, a ne URL s uklonjenom autentifikacijom.
Notes (EN)
When a URL contains an expiring credential, separate stable asset identity from the authenticated retrieval URL and bound any private cache by authorization scope and expiry.
Exceptions / Tradeoffs (EN)
Fine for short-lived, request-scoped use where the URL is never cached beyond the token's own lifetime. Never strip a required token and assume the resource remains accessible. A signed URL may be cached only within its intended lifetime and access scope; resolve a fresh authorized URL when needed.
Iznimke / Tradeoffi (HR)
Kratkotrajna uporaba unutar zahtjeva može biti prihvatljiva. Potpisani URL smije se pohraniti samo unutar njegova roka i ovlaštenog opsega. Ne uklanjaj obavezni token uz pretpostavku da će resurs ostati dostupan; po potrebi dohvaćaj novi autorizirani URL.