Categories
express file-upload formidable node.js

How to securely upload files in Node with Express?

There are many articles, tutorials, and questions about file uploads in node but mostly they are for beginners and none of them fully explains how to secure file uploads for production.
I have tried very hard to find a complete answer on how to do it, but it was not successful.

Below is an explanation of my findings.

  1. Limit file size on uploads:

    app.use(express.limit('4mb'));
  2. Limit file uploads to only certain routes:
    I can’t get this to actually work but here is what I have tried:

    Replace:

    app.use(express.bodyParser());

    with

    app.use(express.json());
    app.use(express.urlencoded());

    and add the multipart middleware to every upload route:

    app.post('/upload', express.multipart(), uploadController.uploadPhoto);

    This part doesn’t work, but the upload works fine if I leave express.bodyParser(). So what am I doing wrong?

  3. Checking uploaded file type before saving upload to disk:

    I couldn’t figure this part out, but a suggestion was to write a custom middleware that uses formidable to parse file uploads and trying to resize the file before it is saved (assuming that it is an image) using a library like image magic. The suggestion was that this would make the image safe and ensure that it is actually an image (because the process would fail if it is not an image).

    This would only work with images though, so it is not a complete solution.

    How can I implement this? Any example code?

Is there anything else that I am missing for uploads to be safe?