Three things a request–response handler is bad at: receiving large files, pushing data to clients, and doing slow work. Each has a standard answer in Nitro, and each has a platform dimension (what works on Node does not necessarily work on serverless). Interviewers ask "how would you handle image uploads" or "how do you send the weekly digest" to see whether you know those answers and their limits.

Know

• Uploads through the server: readMultipartFormData(event) gives you parts with name, filename, type and data (buffered), readFormData gives a web FormData; bound the body size at the proxy and the platform, validate by magic bytes, re-encode images (sharp), random file names, store via useStorage('uploads') (S3/R2 driver) or a bucket SDK, never under public/. Fine for small files; buffering large files in memory is not.
• Presigned URLs for large files: the client asks your API for a presigned PUT URL (S3-compatible: R2, S3, MinIO) with content type and size constraints, uploads directly to the bucket, then notifies your API, which verifies the object (head request, size, type) and records it; the server never touches the bytes. Multipart uploads for very large files; resumable uploads (tus) when networks are bad.
• Serving files: private files through a handler that authorises then streams (sendStream) or redirects to a short-lived presigned GET; public files from the bucket/CDN with Content-Disposition and nosniff; images through @nuxt/image with a provider (Cloudflare Images, IPX) so resizing is cached at the edge.
• Realtime from the server: createEventStream(event) for SSE (works everywhere a response can stream; Last-Event-ID for resumption); defineWebSocketHandler for WebSockets behind nitro.experimental.websocket on crossws, with peer.subscribe/publish for rooms; the handshake carries cookies so getUserSession(peer) authenticates. Scaling: sockets live on one instance, so multi-instance needs a pub/sub backplane (Redis) or platform primitives (Cloudflare Durable Objects); serverless functions cannot hold sockets at all, only stream SSE within their time limit. Managed services when realtime is not the product.
• Nitro tasks: server/tasks/*.ts export defineTask({ meta, run({ payload, context }) }); enable with nitro.experimental.tasks: true; run on demand with runTask('name', { payload }) from a handler or plugin, or on a schedule with nitro.scheduledTasks: { '0 3 * * *': ['cleanup:sessions'] } (cron). In development /_nitro/tasks lists and triggers them. Scheduling support depends on the preset: in-process cron on node-server, Cloudflare Cron Triggers and Vercel Cron on those platforms.
• Queues for reliability: a task started from a request is best-effort; for work that must happen (emails, invoices, webhooks out) use a queue with retries, backoff and a dead-letter queue: Cloudflare Queues, BullMQ on Redis, pg-boss on Postgres, or a managed workflow service (Inngest, Trigger.dev). The outbox pattern writes the job in the same transaction as the business change, and a worker drains it, so nothing is lost between "order saved" and "email sent".
• Idempotency everywhere: jobs and webhooks carry an idempotency key and handlers check it, because retries and at-least-once delivery will run things twice; Idempotency-Key headers for client POSTs that create resources.
• Post-response work: event.waitUntil(promise) (Nitro, mapped to the platform's waitUntil on Cloudflare and Vercel) lets a handler respond immediately and finish logging, analytics or a small side effect afterwards; not for work that must not be lost.
• Long-running work: never in a request handler on serverless (time limits) and never blocking the event loop on Node; chunk it, move it to a worker thread or a task, and report progress over SSE or by polling a job record.
• Observability for jobs: job records with status, attempts and last error, alerts on dead letters and on schedule misses, and a way to re-run.

How it works

Presigned upload with server-side verification, and small-file upload through the server:

import { z } from 'zod'
import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3'
import { getSignedUrl } from '@aws-sdk/s3-request-presigner'

const body = z.object({ contentType: z.enum(['image/png', 'image/jpeg', 'image/webp']), size: z.number().int().max(10 * 1024 * 1024) })

export default defineEventHandler(async (event) => {
  const { user } = await requireUserSession(event)
  const { contentType, size } = await readValidatedBody(event, body.parse)
  const key = `uploads/${user.id}/${crypto.randomUUID()}`
  const s3 = new S3Client({ region: 'auto', endpoint: useRuntimeConfig(event).r2Endpoint, credentials: r2Credentials(event) })
  const url = await getSignedUrl(s3, new PutObjectCommand({ Bucket: 'app-uploads', Key: key, ContentType: contentType, ContentLength: size }), { expiresIn: 300 })
  await useDb().insert(uploads).values({ key, userId: user.id, status: 'pending', contentType, size })
  return { url, key }
})

export default defineEventHandler(async (event) => {
  const { user } = await requireUserSession(event)
  const { key } = await readValidatedBody(event, z.object({ key: z.string() }).parse)
  const record = await useDb().query.uploads.findFirst({ where: (u, { and, eq }) => and(eq(u.key, key), eq(u.userId, user.id)) })
  if (!record) throw createError({ status: 404, statusText: 'Not found' })
  const head = await headObject(key)                          // verify the object really exists with the promised type and size
  if (!head || head.size !== record.size || head.contentType !== record.contentType) throw createError({ status: 400, statusText: 'Upload mismatch' })
  await runTask('images:process', { payload: { key } })       // thumbnails, metadata strip, in the background
  return useDb().update(uploads).set({ status: 'uploaded' }).where(eq(uploads.key, key)).returning()
})

Tasks: a scheduled cleanup and an on-demand processor with idempotency:

export default defineNuxtConfig({
  nitro: {
    experimental: { tasks: true, websocket: true },
    scheduledTasks: { '0 3 * * *': ['sessions:cleanup'], '*/10 * * * *': ['outbox:drain'] },
  },
})

export default defineTask({
  meta: { name: 'images:process', description: 'Generate thumbnails and strip metadata' },
  async run({ payload }) {
    const key = String(payload.key)
    const record = await useDb().query.uploads.findFirst({ where: (u, { eq }) => eq(u.key, key) })
    if (!record || record.status === 'processed') return { result: 'skipped' } // idempotent: safe to run twice
    const original = await getObject(key)
    const thumb = await sharp(original).rotate().resize(320).webp().toBuffer()
    await putObject(`${key}.thumb.webp`, thumb, 'image/webp')
    await useDb().update(uploads).set({ status: 'processed' }).where(eq(uploads.key, key))
    return { result: 'processed' }
  },
})

export default defineTask({
  meta: { name: 'outbox:drain', description: 'Deliver pending jobs with retries' },
  async run() {
    const jobs = await claimPendingJobs(useDb(), 50) // SELECT ... FOR UPDATE SKIP LOCKED: safe with several workers
    for (const job of jobs) {
      try {
        await handlers[job.type]!(job.payload) // each handler idempotent by job.id
        await markDone(useDb(), job.id)
      }
      catch (error) {
        await markFailed(useDb(), job.id, error, { backoffSeconds: 60 * 2 ** job.attempts, maxAttempts: 8 }) // dead-letter after max
      }
    }
    return { result: jobs.length }
  },
})

The outbox written in the same transaction as the business change, and post-response work:

export async function placeOrder(db: Db, input: NewOrder) {
  return db.transaction(async (tx) => {
    const order = await insertOrder(tx, input)
    await tx.insert(outbox).values({ id: crypto.randomUUID(), type: 'email:order-confirmation', payload: { orderId: order.id } }) // same transaction: never lost
    return order
  })
}

export default defineEventHandler(async (event) => {
  const order = await placeOrder(useDb(), input)
  event.waitUntil(trackEvent('order.placed', { orderId: order.id })) // respond now; analytics finishes after
  setResponseStatus(event, 201)
  return toOrderDto(order)
})

Exercise

Be able to say