File Upload Fullstack

Covers the non-obvious parts of a complete upload pipeline: why you never proxy file bytes through your own server, the two-phase commit pattern for upload confirmation, progress tracking without a server round-trip, and the CDN delivery gotchas that break cached files after replacement. Skips basic form handling — assumes a storage bucket exists.

Discovery

Before writing anything, answer:

1. Storage provider: AWS S3, GCS, Cloudflare R2, Azure Blob? (presigned URL API differs per provider)
2. File types and size limits: Images only, or arbitrary files? Max size? (determines chunking strategy)
3. Access control: Public files (CDN-served directly) or private files (signed CDN URLs per request)?
4. Confirmation pattern: Does the backend need to know a file was uploaded? (almost always yes — for DB records, processing jobs, virus scanning)
5. Replacement behavior: Can files be overwritten, or does each upload get a unique key?

Core Patterns