A file upload transfers a file from an HTTP client to an application through a request. ASP.NET Core binds uploaded files to IFormFile for one file or IFormFileCollection for multiple files. section 7.6.3
Treat uploads as untrusted input and decide whether the feature is necessary before implementing it:
- Do not trust the submitted filename; generate a new name before saving the file. section 7.6.3
- Plan carefully for malicious files, oversized requests, accidental denial of service, and files being executed on the server. section 7.6.3 section 16.2.2
- Choose storage deliberately among a database, the filesystem, or another storage system. section 7.6.3
- Use IFormFile for small files because ASP.NET Core buffers the complete file in memory and on disk before the handler receives it. section 7.6.3
Binding one or several files
A minimal API handler can accept an IFormFile parameter for one upload or an IFormFileCollection parameter for several uploads. Razor Pages can bind IFormFile, IFormFileCollection, IEnumerable<IFormFile>, or List<IFormFile> as a handler parameter or binding property. section 7.6.3 section 16.2.2
public interface IFormFile
{
string ContentType { get; }
long Length { get; }
string FileName { get; }
Stream OpenReadStream();
}
Inspect the IFormFile members used to read upload metadata and open a stream, including ContentType, Length, FileName, and OpenReadStream. section 7.6.3
