Use a server-minted presigned URL for the browser upload, and treat CORS as a browser policy rather than an authorization mechanism. For property-management receipts, keep the original in a private object key and make thumbnail creation a prerequisite for any later retention decision.

That is the short answer. The useful part is deciding which system owns each boundary: the application owns identity and deletion state, the bucket owns object access, and the browser is allowed only the cross-origin request that the upload actually needs. When errors occur during browser-based uploads, this split keeps a thumbnail failure from becoming an unexplained retention decision.

How should browser-based thumbnail uploads handle CORS errors?

It tells you very little about the image worker. Browsers block a cross-origin request when the storage response does not grant the requesting origin, method, or headers. A failed preflight can therefore appear beside a perfectly reachable bucket in developer tools.…