Files and object storage
Why not on the server
Files on a local disk break multiple instances, backup and deployment. In object storage you get durability, direct access from a delivery network, and a lifecycle policy.
The right flow
The server issues a short-lived signed address; the client uploads directly; the server gets a notification and updates the record. Less load, less cost, and less waiting time for the user.
On download: the same principle. A signed address with an expiry, so a leaked link isn't eternal.
What to check on the server
The file type by content and not by extension, a size limit, and a scan for malicious content when users upload to others. And file names — never store the name the user gave as a path in the system.
Going deeper
Set a lifecycle policy for media: what gets deleted, when, and how. Storage is the line item that grows quietly, and without a policy it just grows.