On Mon, 9 Nov 2026 at 12:00, yiwei wu <huxiangkun2003@gmail.com> wrote:
The upload service MUST verify that the requester is authorized to delete the file before deleting it. For example, a service can record the bare JID that requested each slot and permit deletion by that bare JID, irrespective of the resource used for the deletion request.
Would it make sense to reuse the Authorization and Cookie headers from the upload request to authenticate the deletion request?
Yes, it was a tempting design to rely on secret information from the initial slot request/response. Unfortunately the client which uploaded the file may not be the same client which deletes the file. The secret information (PUT URL, headers, etc.) is not stored or shared by the uploading client, so is no longer available. The download URL is the main stable identifier we have, and allows e.g. admin deletions as well. Regards, Matthew