File Uploads
Rules
- Presigned URLs for direct-to-storage uploads — don't proxy through your server
- Multipart upload for files > 5MB — chunk into parts, upload in parallel
- Client-side validation: file type, file size limits — server validates again
- Image optimization: resize on upload (max 2048px), convert to WebP, strip EXIF
- Progress tracking:
XMLHttpRequestorfetchwithReadableStreamfor upload progress - Storage: S3, R2 (Cloudflare), or Supabase Storage — presigned URL pattern is the same
- File type validation server-side: check magic bytes, not just file extension
- Virus scanning for user uploads in high-security contexts