Node.js Secure Direct Browser Uploads for Generic Gaming Files (Object Storage at Scale)

For secure direct browser uploads of generic gaming files, utilize Node.js as the intermediary between the browser and object storage. The Node.js application should issue narrow, tenant-scoped permissions to handle data flow while the browser transfers bytes directly to storage. This approach minimizes the Node.js server's involvement in the upload process and optimizes throughput for large-file transfers.

Bypass direct uploads that involve the Node.js server as the primary data pathway, as it can become a bottleneck for large file transfers. Instead, opt for a design where Node.js authorizes the object key and the browser transfers the data to storage. Measure both paths with identical files and client connections to determine the most efficient option.

When implementing the solution, use a short-lived signed operation, a private object, and a key chosen by the trusted application. The browser should first request permission from Node.js to upload a named object, then send the file directly to the URL provided. The application must not share its storage credentials with the browser, and the browser should not attach these credentials to the signed URL.

Avoid having the browser choose the full object key; instead, let the server derive it from authenticated context such as tenants/{tenantId}/products/{productId}/{fileId}-{safeName}. This approach ensures proper operational functionality and efficient metadata searches. Implement the signing call on the server side using TypeScript, with the signing function handling authorization on the server and processing response bodies on failure.