Handling file uploads safely

How a file reaches the server

A normal form sends text. A form with a file is sent as multipart/form-data: the request body is split into parts, one per field, separated by a long random line called the boundary. Each part has its own small headers, such as the file name and type.

POST /api/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----x7Fq

------x7Fq
Content-Disposition: form-data; name="title"

Marksheet
------x7Fq
Content-Disposition: form-data; name="file"; filename="marks.pdf"
Content-Type: application/pdf

%PDF-1.7 ...binary bytes...
------x7Fq--

// Example only: Express + multer
import multer from 'multer';

const upload = multer({
  storage: multer.memoryStorage(),
  limits: { fileSize: 5 * 1024 * 1024, files: 1 }, // 5 MB, one file
});

app.post('/api/upload', upload.single('file'), async (req, res) => {
  // req.file.buffer holds the bytes; check them before saving
  res.status(201).json({ ok: true });
});

Check the size and the real type

Always set a size limit, so nobody can fill your disk or memory with a 10 GB upload. Then check the type. The file name (photo.png) and the Content-Type header both come from the user, so both can lie. A virus can be renamed to cute-cat.jpg in one second.

Where to store files

Do not keep uploads on the app server's disk. Servers get replaced on every deploy, and when you run three servers, each has different files. Use object storage instead: Amazon S3, Cloudflare R2 or Google Cloud Storage. They store any number of files cheaply and safely. Your database stores only the key and details.

CREATE TABLE uploads (
  id INTEGER PRIMARY KEY,
  owner_id INTEGER NOT NULL REFERENCES users(id),
  storage_key TEXT NOT NULL,      -- e.g. uploads/2026/10/3f9c1b7e.pdf
  original_name TEXT,
  mime_type TEXT NOT NULL,
  size_bytes INTEGER NOT NULL,
  created_at TEXT NOT NULL
);

Presigned URLs: upload straight to storage

1. The app asks your backend: "I want to upload a 2 MB PDF".
2. The backend checks the user, the size and the type, and creates a presigned URL: a link that allows one upload to one key for a few minutes.
3. The app uploads the file directly to S3 or R2 with that URL. The big file never passes through your server.
4. The app tells the backend "done", and the backend checks the object exists and saves the row in the database.

// Example only: AWS SDK v3 (works with S3 and Cloudflare R2)
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const key = `uploads/${crypto.randomUUID()}.pdf`;
const url = await getSignedUrl(
  s3,
  new PutObjectCommand({ Bucket: 'my-app-files', Key: key, ContentType: 'application/pdf' }),
  { expiresIn: 300 } // 5 minutes
);

After the upload

• Scan files for viruses (for example with ClamAV or your cloud provider's scanner) before other users can download them.
• Resize images and make thumbnails in a background job (for example with the sharp library), so the upload request returns quickly.
• Remove photo metadata (EXIF), which can contain the exact GPS location where the photo was taken.
• Keep the bucket private and serve files through short-lived signed download links when they are not public.