Another reason to never store temporarily-redirected URLs: They break moderation

In https://hypothesis.zendesk.com/agent/tickets/1513, a group creator received the following notice:

An annotation has been flagged. Please visithttps://hyp.is/dJqbHJ1xEeeLpqNskwWkqg/instructure-uploads.s3.amazonaws.com/account_17700000000000001/attachments/2110683/Patnaik-Becker%20-%20needfinding.pdf?response-content-disposition=attachment%3B%20filename%3D%22Patnaik-Becker%20-%20needfinding.pdf%22%3B%20filename%2A%3DUTF-8%27%27Patnaik%252DBecker%2520%252D%2520needfinding.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJFNFXH2V2O7RPCAA%2F20170918%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20170918T232219Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&X-Amz-Signature=6f3b43a272fb895f5a98a1173dc68ddde1e6c9e4b57b95ae6b514ffbabe39c92 for more details.

You don’t even need to click the link to see the problem. This is a time-limited URL. It happens to come from our Canvas app, but it could be Silverchair or any CMS that enables users to annotate time-limited URLs.

In #feat-canvas on Wed Sep 13 Sean and I were discussing this. He noted:

“What I'm thinking is that the `targetUriOverride` fix will one day be generally applicable to URLs _temporarily_ redirect to other URLs, such that we'd never want to annotate at the final URL or store it in the h DB because it's temporary. If they do HTTP correctly then filestores should uses a 302 or a 307 for such a temporary redirect.”

I agree, and this incident shows one more reason we’d want to do it. When an annotation on a time-limited URL is flagged, the group creator is going to receive an email like the above. We’re just sending you to AWS or Sliverchair or other flavor of HTTP 403 Access Denied page, which is quite disconcerting. And of course there’s no way to visit the page to do anything about the flag on the annotation.