ASP.NET Core Web API Interview Question #183

How should a Web API handle large file uploads?

Senior API Design, Architecture, Scalability & Production Scenarios Senior Advanced

Quick Interview Answer

Enforce explicit size limits and validate file type using more than the client-supplied filename or Content-Type alone. Stream large content rather than buffering the entire file in memory, and store it in an appropriate object/file storage system rather than automatically in the web root.

Detailed Explanation

Enforce explicit size limits and validate file type using more than the client-supplied filename or Content-Type alone. Stream large content rather than buffering the entire file in memory, and store it in an appropriate object/file storage system rather than automatically in the web root.

Use randomized server-side names, malware scanning where required, authorization, quotas, and lifecycle controls. Do not trust uploaded paths or filenames.

Code Example

[RequestSizeLimit(100_000_000)]
[HttpPost("upload")]
public async Task<IActionResult> Upload(
    IFormFile file,
    CancellationToken token)
{
    // Validate size/type and stream to controlled storage.
    return Accepted();
}