Is it possible to upload a file to Dropbox without storing it on my server first using PHP?

Currently, I have a PHP app running on Heroku using a Postgresql database. I want my users to be able to upload an image to a folder on my dropbox, and store other information (in this case, product information such as price, title, weight, location of the image on dropbox) on my database.

Right now, I’m using a file input inside an HTML form to submit the image by posting the whole form to my server (including the image), and then I use cURL to send the image to dropbox and wait for the response to succeed. On success, I create my database record that has the other information I mentioned earlier.

This works well for small files, but Heroku has a 30 second timeout that I can’t change. For large files, the whole file uploads to the server, and then it uploads to dropbox. These two upload operations are time-intensive and takes more time than the timeout allows.

I had the idea of sending the file to dropbox using javascript (jQuery ajax commands specifically) so that it’s handled by the client, and then POSTing to my server on success, but I’m worried about how secure that is since I would need to have my own authorization tokens in the source code that the client can view.

Is there any way for PHP to send a file from the client to an external URL without it touching the server? How do I do this securely?

Answer

This sounds like a good fit for the Dropbox API /2/files/get_temporary_upload_link endpoint.

You can call that on your server to retrieve the temporary upload link, and then pass that link down to the browser. You can then have some JavaScript code perform the upload directly from the browser using that link.

Since only the /2/files/get_temporary_upload_link endpoint call requires your Dropbox access token (whereas the temporary upload link itself doesn’t), you can keep your access token secret on the server only, without exposing it to the client. And since the upload happens directly from the browser to the Dropbox servers, you don’t have to pass the file data through your own server, avoiding the timeout issue.