Tenant-Isolated Avatar Intake: Browser CORS Preflight and Presigned PUT Boundaries (US/EU)
Short answer: a presigned PUT can authorize an object write, but it cannot make a browser ignore CORS. For a media product with US and EU application origins, treat the preflight response as a governance boundary: use direct upload only…