backend – Best Practices for Storing User-Uploaded Files in a Node.js/Express Application

Public folders in Express let the app serve static files. And every content in it will be directly accessible to users.

However, there is no Public folder in Express by default.

Public folders are configured using middleware softwares.
express.static – the built-in middleware software in Express, is one of such middleware softwares.
This middleware enables the given folders public for read access.

Users still cannot write to these public folders. Users can neither create nor remove content from these public folders. It means to say that, direct upload to public folders or direct removal from the same are impossible unless write functionality is enabled separately.
Multer is a middleware which can enable file upload. Being a separate middleware, it provides its own set of configuration options, of which storage destination is one of the main options. The destination can be either the same server, or another one.
However, it is to note that this is the middleware which provides write functionality.

Now it is up to the app to configure the folders. If the same folder is configured in both of these middleware softwares,
then the same folder will become public for both read and write access. In this case, the upload will not be protected.
Otherwise, if read and write are configured into separate folders, then there will be separate public and protected folders.
And users will not be able to access protected folders directly.

Citations:

Serving static files in Express

Multer