Building a Secure Image Upload and Processing Pipeline
Image upload is one of the easiest ways to introduce security and reliability debt into a SaaS app. Users upload huge files, wrong types, or malicious payloads. A solid pipeline treats upload as an untrusted input channel end to end.
High-Level Pipeline
Client → signed upload URL / API
→ validate type + size
→ store in private object storage
→ async process (resize, strip metadata)
→ write derived assets
→ serve via CDN with short-lived URLs or public derived onlyValidate Before You Trust
- Allowlist MIME types and extensions (
image/jpeg,image/png,image/webp) - Enforce max size on client and server
- Verify magic bytes, not only the
Content-Typeheader - Reject SVG by default unless you sanitize carefully (XSS risk)
Prefer Direct-to-Storage Uploads
For large files, the API issues a short-lived signed URL. The browser uploads directly to object storage. The API never buffers multi-megabyte bodies in memory.
Process Asynchronously
After the object lands, a worker:
- Re-validates the file
- Strips EXIF when privacy requires it
- Generates thumbnails / web-sized variants
- Stores results under a deterministic key scheme
- Updates the database row to
readyorfailed
Access Control
- Originals stay private by default
- Derived public assets use non-guessable keys or signed URLs
- Delete originals when the owning entity is deleted
- Rate-limit uploads per user and per IP
Minimal API Sketch
// 1) client requests upload permission
POST /api/uploads/images
{ "contentType": "image/jpeg", "byteSize": 842133 }
// 2) server returns signed URL + uploadId
// 3) client PUT bytes to storage
// 4) client confirms
POST /api/uploads/images/:id/completeOperational Concerns
- Dead-letter queue for failed processing jobs
- Timeouts and memory limits on image libraries
- Quotas by plan (storage GB and monthly upload count)
- Clear user-facing errors when processing fails
Final Thoughts
A secure image pipeline is validation + private storage + async processing + least-privilege delivery. Skip any one of those and you eventually pay in incidents or support load.
Written by A.M. Rinas · Published August 30, 2026
