A 311 photo-upload API currently waits for virus scan and thumbnail generation before returning HTTP 200, causing citizen timeouts on large images. What should developers change?
Select an answer to reveal the explanation.
Short Explanation
Do not make the citizen stand at the counter while someone scans and shrinks the photo in the back room. Take the upload, say thanks, and finish the heavy work on a queue or S3 event. Fast sync path, async for the long jobs.
Full Explanation
A 311 photo-upload API that waits for virus scan and thumbnail generation before returning HTTP 200 forces citizens into timeouts on large images. Developers should accept the upload quickly on the synchronous path, then offload virus scan and thumbnails asynchronously via SQS or an S3 event. The interactive contract becomes “upload received and durable”; heavy processing continues out of band with status updates or webhooks when ready. That pattern protects UX under variable image sizes while still enforcing security scanning before public gallery publication.
Keeping the synchronous wait but raising client timeouts to several minutes merely shifts pain to mobile users on poor networks and still ties API concurrency to slow CPU work. Moving virus scan and thumbnails into the API Gateway request validator misunderstands Gateway validators—they check shape and basic constraints, not antivirus or image transcoding. Rejecting every image larger than 100 KB avoids async design by degrading the product; field photos from code enforcement routinely exceed that size.
Exam caveat: “accept quickly” still requires durable storage and an authZ check on the sync path. Do not return success for malware that later fails scan without a remediation workflow. Idempotent processing keys prevent duplicate thumbnails when S3 events retry.
Operational check: store the object, return 202/200 with a tracking ID, trigger scan/thumbnail asynchronously, block public read until scan clears, surface processing status to the 311 UI, and alarm on DLQ or failed-scan queues so unsafe objects never publish.