How do I upload files in an Express API safely?

Question

Users need to upload profile pictures. I'm using `multer` and saving to `./uploads`. What should I watch out for?

Accepted Answer

Key safeguards:

1. **Limit size**: `multer({ limits: { fileSize: 2 * 1024 * 1024 } })`.
2. **Validate the real type**, not the client-provided MIME or extension. Check magic bytes with `file-type`, and only allow `image/jpeg|png|webp`.
3. **Re-encode images** with `sharp`. This strips EXIF (including GPS location!) and neutralizes polyglot files.
4. **Never use the original filename** on disk. Generate one with `crypto.randomUUID()`.
5. **Don't serve uploads from your app's origin** with executable types. Better: store them in object storage (S3, R2, Supabase Storage) and serve them from a separate domain or CDN.
6. Rate-limit the upload endpoint.

```js
const buf = await sharp(req.file.buffer)
  .rotate()
  .resize(512, 512, { fit: 'cover' })
  .webp({ quality: 80 })
  .toBuffer();
```

1 Answer