Node.js Avatar Uploads to S3-Compatible Storage: Metadata, Retention and Private Links

The article argues that avatars should be stored as private objects, with their generated keys and metadata recorded in a database, and accessed through short-lived signed URLs only when needed. Node.js handles authentication, file validation, key generation and the database transaction, while the storage service holds the image bytes. It recommends checking the decoded file type rather than trusting the Content-Type header, enforcing a byte limit before reading the request body, and treating the size limit and deletion schedule as separate controls. The piece includes sample TypeScript code for saving an avatar and notes that an idempotent replacement path and a cleanup strategy for failed inserts are needed. It concludes with a brief example of a REST-based upload request.