Customer support reports have an awkward boundary: the browser should move bytes quickly, but it should never decide where a customer's file lives. Short answer: let a Node backend authorize a tenant-scoped key and presigned upload URL, let Vue/Axios upload directly with progress events, then issue a short-lived signed read URL only when an authenticated customer asks for the report.

That split keeps credentials and naming policy on the server while avoiding a second hop for the file itself. It also gives the UI an honest progress bar instead of pretending that a completed POST means the object is durable.

The constraint is authorization, not the progress bar

The tempting implementation is a browser POST to your Node server, followed by a server-side upload.…