“Vercel Blob URLs, although publicly accessible, are unique and hard to guess.
This is similar to Share a file publicly in Google Docs. You should ensure that the URLs are only shared to authorized users.”
I’m not sure why the documentation says, “URLs are only shared to authorized users.”
Does this mean that I should NOT expose my Vercel Blob in Next.js Image component’s “src” attribute like:
Is this because a malicious user could get the location (URL) of my vercel blob and image locations and perform a ton of unneeded requests for my images to run up my vercel blob bill?
No. It’s pretty typical, and safe for public website assets, like images, to use the blob URL directly. I interpret the documentation’s suggestion about “authorized users” as more for sensitive documents or private assets rather than public images.
For clarity I guess It is still possible for malicious activity to happen, but that’s why Vercel has dDos protection and rate limiting in place. Using the Next.js Image component also helps through automatic image optimizations and caching to help reduce the request back to your blob storage.