ASP.NET Core Interview Question #237

How would you upload large files safely in ASP.NET Core?

Senior ASP.NET Core Real-World Scenarios Senior Advanced

Quick Interview Answer

Set explicit size limits and validate the upload according to business requirements. Do not trust the client-provided file name or Content-Type as proof of file contents. Generate a server-side storage name and keep untrusted uploads outside executable application paths.

Detailed Explanation

For large files, prefer streaming to bounded storage rather than buffering the entire file in memory. Apply authentication and authorization, enforce quotas, scan files when required, and clean up incomplete uploads.

When using cloud object storage, direct-to-storage upload patterns can reduce load on the web application if the security model supports them.

Code Example

[HttpPost]
[RequestSizeLimit(100_000_000)]
public async Task<IActionResult> Upload(
    IFormFile file,
    CancellationToken ct)
{
    if (file.Length == 0) return BadRequest();

    var safeName = Guid.NewGuid().ToString("N");
    await _fileStore.SaveAsync(safeName, file.OpenReadStream(), ct);
    return Ok();
}