Large uploads should usually go directly from the client to object storage rather than passing through an application server that must relay every byte. The API authorizes an upload, creates a short-lived signed URL or multipart-upload session, and records a pending asset.

Treat client metadata as untrusted. Enforce size limits, permitted content types, ownership, quotas, and checksum validation. File extensions and browser-supplied MIME types can be forged; inspect content and scan files where the threat model requires it. Keep newly uploaded files private until validation and processing complete.

Multipart uploads improve resilience for large objects by allowing parts to retry independently. Expire abandoned upload sessions and clean up orphaned objects. Signed URLs should have narrow permissions and limited lifetimes, and logs should not expose reusable signatures.