I’m trying to create a custom service endpoint in Azure DevOps Server that acts as a proxy to download files from an external S3 server. The goal is to allow users to download these files through Azure DevOps without exposing the S3 server URL directly. Here are the details of what I’m trying to achieve:

Manifest File: I have a manifest file for my Azure DevOps extension that includes a custom service endpoint contribution.

{
    "manifestVersion": 1,
    "id": "s3Proxy",
    "publisher": "timofei-publisher",
    "version": "1.0.7",
    "name": "S3 Proxy Extension",
    "description": "Azure DevOps extension sample",
    "categories": [
        "Azure Pipelines"
    ],
    "targets": [
        {
            "id": "Microsoft.VisualStudio.Services"
        }
    ],
    "scopes": [
        "vso.serviceendpoint_manage",
        "vso.serviceendpoint_query"
    ],
    "contributions": [
        {
            "id": "custom-service-endpoint",
            "type": "ms.vss-web.service-endpoint",
            "description": "Custom service endpoint for Azure DevOps",
            "properties": {
                "name": "CustomServiceEndpoint",
                "uri": "/_apis/customserviceendpoint",
                "scopes": ["vso.serviceendpoint_manage", "vso.serviceendpoint_query"]
            }
        }
    ],
    "files": [
        {
            "path": "bin/*",
            "addressable": true
        }
    ]
}

Controller Code: I have implemented a custom controller in ASP.NET MVC to handle the proxy logic.

using System;
using System.Net.Http;
using System.Threading.Tasks;
using System.Web.Mvc;

namespace S3Proxy.Controllers
{
    public class CustomServiceEndpointController : Controller
    {
        [HttpGet]
        [Route("_apis/customserviceendpoint")]
        public async Task<ActionResult> GetLinkStream(string filePath)
        {
            string baseUrl = "https://storage.yandexcloud.net/";
            string imageUrl = $"{baseUrl}{filePath}";

            using (HttpClient httpClient = new HttpClient())
            {
                try
                {
                    byte[] fileBytes = await httpClient.GetByteArrayAsync(imageUrl);
                    return File(fileBytes, "application/octet-stream");
                }
                catch (HttpRequestException ex)
                {
                    Console.WriteLine($"Error downloading file: {ex.Message}");
                    return new HttpStatusCodeResult(500, $"Error downloading file: {ex.Message}");
                }
            }
        }
    }
}

My Questions:
Is this the correct approach to create a custom service endpoint within Azure DevOps Server to act as a proxy for downloading files from an external S3 server?
Can I use a relative URL in the manifest to ensure the endpoint works correctly across different Azure DevOps Server instances?
How do I ensure proper authentication and authorization for this endpoint within Azure DevOps?
Are there any best practices or potential pitfalls I should be aware of when implementing this proxy logic in Azure DevOps Server?
Any guidance or examples would be greatly appreciated!