Files, storage, and CDNs

A database is good at small, structured facts. A 4 MB photo is neither. Files go to object storage: a service that stores blobs under a path and serves them by URL. The database keeps only the path.

Public and private

A public file has a permanent URL anyone can open. Right for logos, product photos, and anything shown on a page.

A private file has no public URL. To let someone see it, the server mints a signed URL: the path plus an expiry time plus a signature that proves the server approved it. Open it after the expiry and it fails. Right for invoices, uploads, and anything tied to one user.

Never save a signed URL anywhere permanent. Save the path, and sign again each time it is shown.

The CDN in front

Public files are served through a CDN, which caches copies near visitors. The first request for a file reaches storage; the next thousand from the same region are answered by the cache. This is why a changed file at the same path can keep showing the old version for a while, and why new uploads usually get new paths.

Uploads

Large uploads should not pass through your app server at all. The server hands the browser a short-lived upload URL, the browser sends the bytes straight to storage, and only the path comes back. Your server stays free to answer other requests.

Where DontCode fits

Every project has a public bucket and a private bucket, namespaced to the project. The Files page uploads to either; private files come back as signed URLs that expire after one hour by default. The public API offers a presigned upload for files over 100 MB.