Implementing File Upload Logic
1. Implementing Multipart Upload Handler
Example: Spring MultipartFile
@PostMapping(value = "/files", consumes = MULTIPART_FORM_DATA_VALUE)
public FileMeta upload(@RequestPart("file") MultipartFile file,
@RequestPart("meta") Meta meta) throws IOException {
return storage.store(file.getOriginalFilename(),
file.getContentType(),
file.getInputStream(),
file.getSize());
}2. Implementing File Validation
| Check | Detail |
|---|---|
| Size limit | Reject > max |
| MIME type | Detect from content (Apache Tika), not header |
| Extension | Allow-list only |
| Magic bytes | Verify file signature |
| Filename | Sanitize; prevent path traversal |
3. Implementing Storage Logic
| Backend | Use |
|---|---|
| Local FS | Dev only; not horizontally scalable |
| S3 / GCS / Azure Blob | Production cloud |
| MinIO | S3-compatible self-hosted |
| DB BLOB | Small files, transactional needs |
4. Implementing Chunked Upload
| Step | Detail |
|---|---|
| Initiate | Create upload session, get ID |
| Upload parts | Sequential or parallel chunks |
| Complete | Server assembles in order |
| S3 multipart | 5 MB min part, 10 000 max parts |
| tus.io protocol | Resumable upload standard |
5. Implementing Resume Upload Logic
| Mechanism | Detail |
|---|---|
| HEAD upload | Returns bytes received |
| Range header | Client resumes from offset |
| Session TTL | Cleanup incomplete uploads |
6. Handling Large File Uploads
| Strategy | Detail |
|---|---|
| Stream, don't buffer | Avoid OOM |
| Pre-signed PUT URL | Direct browser → S3, bypass app |
| Chunked + parallel | Faster + resumable |
| Async post-process | Virus scan, transcode in background |
7. Implementing Virus Scanning
| Tool | Detail |
|---|---|
| ClamAV | Open-source, INSTREAM scan |
| Cloud (S3 + Lambda) | Trigger on upload |
| Quarantine | Mark unscanned; serve only after clean |
| Re-scan | On signature DB updates |
8. Implementing Image Processing
| Operation | Tool |
|---|---|
| Resize | Thumbnailator, ImageMagick, libvips |
| Format convert | WebP/AVIF for web |
| Strip EXIF | Remove location/PII metadata |
| CDN transform | Cloudinary, imgproxy on demand |
9. Implementing Cloud Storage Integration
Example: AWS S3 PutObject
S3Client s3 = S3Client.create();
s3.putObject(PutObjectRequest.builder()
.bucket("uploads")
.key("u/" + userId + "/" + uuid + "/" + safeName)
.contentType(contentType)
.serverSideEncryption(ServerSideEncryption.AES256)
.build(), RequestBody.fromInputStream(stream, size));10. Implementing Pre-Signed URLs
Example: Pre-signed PUT
S3Presigner presigner = S3Presigner.create();
PresignedPutObjectRequest pre = presigner.presignPutObject(b -> b
.signatureDuration(Duration.ofMinutes(15))
.putObjectRequest(p -> p.bucket("uploads").key(key).contentType(ct)));
return pre.url().toString(); // client uploads directly11. Implementing Upload Progress Tracking
| Mechanism | Detail |
|---|---|
| Client-side | XMLHttpRequest progress events |
| Server-side | Per-part offset for chunked uploads |
| WebSocket / SSE | Push progress to UI |
12. Implementing File Deletion Logic
| Practice | Detail |
|---|---|
| Soft delete first | Mark in DB; physical delete async |
| Authorization | Verify owner / permission |
| Cascade | Delete derived (thumbnails, conversions) |
| Audit log | Who deleted, when |
| Lifecycle policies | S3 auto-purge old versions |