diff --git a/app/auth/views/facebook.py b/app/auth/views/facebook.py
index 3de8282c..58756e36 100644
--- a/app/auth/views/facebook.py
+++ b/app/auth/views/facebook.py
@@ -102,7 +102,7 @@ def facebook_callback():
     if user:
         if picture_url and not user.profile_picture_id:
             LOG.d("set user profile picture to %s", picture_url)
-            file = create_file_from_url(picture_url)
+            file = create_file_from_url(user, picture_url)
             user.profile_picture_id = file.id
             db.session.commit()
 
@@ -120,10 +120,11 @@ def facebook_callback():
         user = User.create(
             email=email.lower(), name=facebook_user_data["name"], activated=True
         )
+        db.session.flush()
 
         if picture_url:
             LOG.d("set user profile picture to %s", picture_url)
-            file = create_file_from_url(picture_url)
+            file = create_file_from_url(user, picture_url)
             user.profile_picture_id = file.id
 
         db.session.commit()
diff --git a/app/auth/views/google.py b/app/auth/views/google.py
index 1a69d59e..eb92a8c6 100644
--- a/app/auth/views/google.py
+++ b/app/auth/views/google.py
@@ -88,7 +88,7 @@ def google_callback():
     if user:
         if picture_url and not user.profile_picture_id:
             LOG.d("set user profile picture to %s", picture_url)
-            file = create_file_from_url(picture_url)
+            file = create_file_from_url(user, picture_url)
             user.profile_picture_id = file.id
             db.session.commit()
     # create user
@@ -105,10 +105,11 @@ def google_callback():
         user = User.create(
             email=email.lower(), name=google_user_data["name"], activated=True
         )
+        db.session.flush()
 
         if picture_url:
             LOG.d("set user profile picture to %s", picture_url)
-            file = create_file_from_url(picture_url)
+            file = create_file_from_url(user, picture_url)
             user.profile_picture_id = file.id
 
         db.session.commit()
@@ -133,9 +134,9 @@ def google_callback():
     return after_login(user, next_url)
 
 
-def create_file_from_url(url) -> File:
+def create_file_from_url(user, url) -> File:
     file_path = random_string(30)
-    file = File.create(path=file_path)
+    file = File.create(path=file_path, user_id=user.id)
 
     s3.upload_from_url(url, file_path)
 
diff --git a/app/dashboard/views/setting.py b/app/dashboard/views/setting.py
index f40f4bc4..9b95d807 100644
--- a/app/dashboard/views/setting.py
+++ b/app/dashboard/views/setting.py
@@ -106,7 +106,7 @@ def setting():
 
                 if form.profile_picture.data:
                     file_path = random_string(30)
-                    file = File.create(path=file_path)
+                    file = File.create(user_id=current_user.id, path=file_path)
 
                     s3.upload_from_bytesio(
                         file_path, BytesIO(form.profile_picture.data.read())
diff --git a/app/developer/views/client_detail.py b/app/developer/views/client_detail.py
index 8cca2a11..8f277a08 100644
--- a/app/developer/views/client_detail.py
+++ b/app/developer/views/client_detail.py
@@ -45,7 +45,7 @@ def client_detail(client_id):
             # todo: remove current icon if any
             # todo: handle remove icon
             file_path = random_string(30)
-            file = File.create(path=file_path)
+            file = File.create(path=file_path, user_id=client.user_id)
 
             s3.upload_from_bytesio(file_path, BytesIO(form.icon.data.read()))