Vercel Blob URLs public?

(edited)

The documentation for Vercel Blob states:

"Vercel Blob URLs, although publicly accessible, are unique and hard to guess. This is similar to Share a file publicly in Google Docs. You should ensure that the URLs are only shared to authorized users."

I'm not sure why the documentation says, "URLs are only shared to authorized users."

Does this mean that I should NOT expose my Vercel Blob in Next.js Image component's "src" attribute like:

<Image src="https://UNIQUE-STRING.public.blob.vercel-storage.com/my-imgs/flower.webp" />

Is this because a malicious user could get the location (URL) of my vercel blob and image locations and perform a ton of unneeded requests for my images to run up my vercel blob bill?

Accepted answer

No. It’s pretty typical, and safe for public website assets, like images, to use the blob URL directly. I interpret the documentation's suggestion about "authorized users" as more for sensitive documents or private assets rather than public images.

For clarity I guess It is still possible for malicious activity to happen, but that’s why Vercel has dDos protection and rate limiting in place. Using the Next.js Image component also helps through automatic image optimizations and caching to help reduce the request back to your blob storage.

Ok, I will use the blob URL directly on an Image component's "src" attribute then since these are public assets.

<Image src="https://UNIQUE-STRING.public.blob.vercel-storage.com/my-imgs/flower.webp" />

Next.js cached/optimized images stored in "_next/image" are given image names that include the original "src" attribute used on the <Image component.

So clients/users can see your blob URL in the "src" attribute even on cached images coming from "_next/image."

Which is not a problem... since again, these are public assets/images.

I am assuming the built-in DDoS protection you mentioned applies to both vercel blob and next.js app hosting contexts?

Thanks for the thorough response!

This topic is closed. It no longer accepts new replies.