How to Architect Private Image Storage and Signed Thumbnails in Node.js

A recommended architecture for Node.js SaaS applications stores private original images and generated thumbnails in object storage, while delegating resizing to a dedicated application worker. Each image variant is recorded in the application database using deterministic key naming conventions, such as originals/{tenant}/{asset_id} and thumbs/{tenant}/{asset_id}/{variant}.webp, ensuring consistent retrieval and avoiding duplicate objects. Clients receive short-lived presigned GET URLs for secure access, while backend workers upload variants via presigned PUT or authenticated calls, keeping authorization tokens separate from returned URLs. The design enforces two core invariants: all images remain private or signed-only, and every resize request maps to exactly one database record and one storage key to prevent race conditions. Developers are cautioned that object storage alone lacks features like conditional writes, versioning, object lock, and automatic multipart cleanup, making external coordination essential for production reliability.