title: AWS getSignedUrl expiry in Node.js
body: <p>I am generating a signed URL for an object in S3 like so:</p>
  <pre><code>const s3 = new AWS.S3({
    region: &quot;eu-west-2&quot;,
    endpoint: &quot;s3.eu-west-2.amazonaws.com&quot;,
    signatureVersion: &quot;v4&quot;,
  });
  
  s3.getSignedUrl(
    &quot;getObject&quot;,
    {
      Bucket: &quot;soliloquy-app&quot;,
      Key: key,
      Expires: 30,    // &lt;-- HERE
    },
    (err, url) =&gt; {
        return res.status(200).send(url);
    }
  );
  </code></pre>
  <p>The URL it generates is like so:</p>
  <p><a href="https://soliloquy-app.s3.eu-west-2.amazonaws.com/iw0EuRb6C4Ab2BFTimomVjEI4HK15FNX.mp3?X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=AKIAZMWVPARKDIXWFYPM%2F20220830%2Feu-west-2%2Fs3%2Faws4_request&amp;X-Amz-Date=20220830T151912Z&amp;X-Amz-Expires=30&amp;X-Amz-Signature=f8d7490cc2f45cd9e6cdacbe50d9f2da110f4960d86254ab702581d3395d79f9&amp;X-Amz-SignedHeaders=host" rel="nofollow noreferrer">https://soliloquy-app.s3.eu-west-2.amazonaws.com/iw0EuRb6C4Ab2BFTimomVjEI4HK15FNX.mp3?X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=AKIAZMWVPARKDIXWFYPM%2F20220830%2Feu-west-2%2Fs3%2Faws4_request&amp;X-Amz-Date=20220830T151912Z&amp;X-Amz-Expires=30&amp;X-Amz-Signature=f8d7490cc2f45cd9e6cdacbe50d9f2da110f4960d86254ab702581d3395d79f9&amp;X-Amz-SignedHeaders=host</a></p>
  <p>I actually have 2 problems with this URL:</p>
  <p>Firstly, and more importantly it never seems to expire. I passed 30 seconds as the expiry <a href="https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html#getSignedUrlPromise-property" rel="nofollow noreferrer">as per the documentation</a>, but the URL seems to be permanently accessible. Why would the expire time be in the URL anyway? Obviously changing it here should not allow you to download it if it did work (which it doesn't), so why have it here?</p>
  <p>Secondly, when I put that URL into into the browser, it tries to download it instead of streaming it. Can I set the content type in the GET req?</p>