Creating a unique filename (hash) for user uploaded images

Question

I have a web application that allows users to upload images. I store the images in an S3 bucket and give them all filenames that are essentially the result of MD5(session_id + unix_timestamp). Are there any pitfalls of this method for creating unique image filenames?

Answer 1

I would consider storing the files with some sort of folder format, as many UI based S3 clients will work much better if there is not 200,000 files in one folder. Also it would not hurt to also add the correct extension and mime type to the uploaded files. That way - if you decide to serve them directly from S3 to a web page, etc - they will be ready to go.

2012/2/6gtbb88uytgfrses4.png

Also you could put the dimensions in the name...

2012/2/6gtbb88uytgfrses4_600x800_.png

Answer 2

From a uniqueness standpoint, you should be safe. Collisions are not likely (although possible) to occur when using MD5.

But, if you want to provide users with the download of this files, I assume you are storing the original file names elsewhere (database or similar). Is that right? If that is right, you might as well store the session ID and timestamp on the same place, and just go ahead with a GUID for the file name (instead of providing them to your MD5 hash function), which would be safer from a collision standpoint.