← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

Object Storage

cloud PHP 5.0+ Intermediate

Also Known As

S3 GCS Azure Blob object storage S3-compatible

TL;DR

A flat-file storage system (S3, GCS, Azure Blob) where files are stored as objects with metadata and accessed via HTTP — infinitely scalable, separate from application servers.

Explanation

Object storage differs from block storage (disks) and file storage (NFS): objects are immutable, identified by key, and accessed via HTTP API. Key features: built-in redundancy across availability zones, lifecycle policies (auto-archive to cheaper tiers), pre-signed URLs for temporary direct access, static website hosting, and CDN integration. PHP applications should store uploads in S3 rather than the server filesystem — files persist across deployments and are accessible from all scaled instances.

Diagram

flowchart LR
    APP[PHP App] -->|PUT object| BUCKET[(S3 Bucket)]
    BUCKET -->|CDN origin| CF[CloudFront<br/>edge cache]
    CF --> USERS[Global users<br/>low latency]
    subgraph Storage_Classes
        STD[Standard<br/>frequent access]
        IA[Infrequent Access<br/>cheaper]
        GLACIER[Glacier<br/>archive]
    end
    subgraph Features
        VER[Versioning<br/>restore deleted]
        ENC[Encryption<br/>SSE-S3 or KMS]
    end
style BUCKET fill:#d29922,color:#fff
style CF fill:#1f6feb,color:#fff
style GLACIER fill:#6e40c9,color:#fff

Common Misconception

S3 is slow because it's HTTP-based — S3 is designed for throughput and consistently delivers 100-500MB/s; for most web applications it is faster than local disk when served via CloudFront.

Why It Matters

Storing uploads on the application server filesystem breaks when the server is scaled out (other servers can't access files) and files are lost when a serverless function exits or a container restarts.

Common Mistakes

  • Storing sensitive files in a public S3 bucket — use pre-signed URLs for private content, not public bucket policies.
  • Streaming large files through PHP to the client — generate a pre-signed URL and redirect; avoids memory usage and latency.
  • Not setting lifecycle rules — old temporary files accumulate indefinitely without automatic expiry.
  • Uploading to S3 synchronously in a web request — offload to a queue worker for large files.

Code Examples

✗ Vulnerable
// Streaming through PHP — wastes memory and adds latency:
function downloadFile(string $key): void {
    $content = $s3->getObject(['Bucket' => 'my-bucket', 'Key' => $key])['Body'];
    header('Content-Type: application/octet-stream');
    echo $content; // Entire file in PHP memory
}
✓ Fixed
// Pre-signed URL — client downloads directly from S3:
function downloadFile(string $key): string {
    $cmd = $s3->getCommand('GetObject', ['Bucket' => 'my-bucket', 'Key' => $key]);
    $request = $s3->createPresignedRequest($cmd, '+15 minutes');
    return (string) $request->getUri(); // Redirect client to this URL
}
// In controller:
return redirect($s3Service->downloadFile($key));

Added 15 Mar 2026
Edited 22 Mar 2026
Views 24
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings W 0 pings T 0 pings F 0 pings S 0 pings S 2 pings M 0 pings T 0 pings W 0 pings T 1 ping F 0 pings S 1 ping S 0 pings M 0 pings T 0 pings W 0 pings T 1 ping F 1 ping S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 1 ping F 0 pings S 1 ping S 1 ping M 0 pings T 0 pings W 0 pings T
No pings yet today
No pings yesterday
Amazonbot 6 Perplexity 6 Unknown AI 2 Google 2 Ahrefs 2 SEMrush 2
crawler 19 crawler_json 1
DEV INTEL Tools & Severity
🟠 High ⚙ Fix effort: Medium
⚡ Quick Fix
Block all public access at account level, enable versioning and server-side encryption by default, and generate pre-signed URLs for time-limited user access instead of making buckets public
📦 Applies To
PHP 5.0+ web cli laravel
🔗 Prerequisites
🔍 Detection Hints
S3 bucket with public read ACL; files served directly from S3 without signed URLs; no server-side encryption; access keys in PHP code for S3
Auto-detectable: ✓ Yes aws-config semgrep trufflehog scout-suite
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✗ Manual fix Fix: Medium Context: File
CWE-732 CWE-312

✓ schema.org compliant