File Storage & Uploads
Why almost no product stores uploaded files in its own database or on its own web server.
5.11.1Definition
File storage handles anything a user or system uploads that isn't structured row-and-column data — images, videos, documents, exports. Nearly all products delegate this to object storage (Amazon S3, Cloudflare R2, Google Cloud Storage) rather than the application server's own disk or the primary database.
5.11.2Why It Exists
Application servers are typically ephemeral and horizontally scaled (5.15) — a file saved to one server's disk may not exist on the server that handles the next request. Storing large binary files in a relational database also bloats backups and slows queries. Object storage exists as a purpose-built, durable, infinitely-scaling layer specifically for this kind of unstructured data, decoupled entirely from application server lifecycle.
5.11.3The Upload Flow
- Direct-to-storage uploads — the client uploads directly to object storage using a short-lived signed URL the backend generates, rather than routing the file through the application server at all.
- Validation before trust — file type, size, and (where relevant) content are validated server-side, never trusting the client-declared MIME type alone.
- CDN delivery — uploaded files are served back to users through a CDN (1.6) rather than directly from storage, for speed and to offload bandwidth.
5.11.4Common Mistakes
- Routing every upload through the application server, consuming server memory and bandwidth for large files that could have gone directly to storage.
- Trusting the client-declared file extension or MIME type without server-side verification, allowing a disguised executable to be uploaded as an "image."
- No file size limits enforced server-side, allowing a single upload to exhaust storage quota or bandwidth.
- Publicly readable storage buckets with no access control, exposing every uploaded file — including ones meant to be private — to anyone with the URL.
5.11.5Best Practices
- Use signed, time-limited URLs for direct client-to-storage uploads wherever the provider supports it.
- Validate file type and size server-side regardless of what the client claims.
- Default storage buckets to private, exposing only what's explicitly meant to be public.