ASP.NET Core MVC Interview Question #188
How would you implement large file uploads safely?
Senior Practical MVC Scenarios & Production Architecture Senior Advanced
Quick Interview Answer
Enforce application-defined size limits, authorization, allowed content rules, and safe storage names. Never combine an untrusted client filename directly with a server path, and do not rely only on the file extension to establish content safety.
Detailed Explanation
Enforce application-defined size limits, authorization, allowed content rules, and safe storage names. Never combine an untrusted client filename directly with a server path, and do not rely only on the file extension to establish content safety.
For very large uploads, consider streaming instead of buffering the entire file in memory. Store uploaded files outside executable application locations when appropriate and use malware/content scanning according to the risk profile.
Code Example
var safeName = $"{Guid.NewGuid():N}.bin";
var path = Path.Combine(uploadRoot, safeName);
await using var stream = System.IO.File.Create(path);
await file.CopyToAsync(stream, token);