Browser Direct-to-Storage Upload for Node.js SaaS: 4 Presigned URL and CORS Rules

For Node.js and Next.js SaaS products, browser direct-to-storage uploads should utilize short-lived presigned URLs authorized via server actions. Files must remain private, with the application database managing retention and deletion states rather than the storage provider. Selection of S3-compatible providers requires testing CORS, recovery, and residency. Costs depend on egress and operational labor, not just storage rates. Access control must remain separate from delivery, ensuring read authorization precedes the issuance of expiring download URLs.