topic
Verified 2026-09-18

Multipart Requests and Uploads

Multipart media types package multiple parts, commonly form fields and uploaded files, in one HTTP message.

Parse boundaries with a standards-compliant streaming parser, enforce per-file and total limits, validate content independently of filenames, and store uploads outside executable paths.

httpuploadsapisecurity

Reference (http)

Content-Type: multipart/form-data; boundary=example-boundary

--example-boundary
Content-Disposition: form-data; name="file"; filename="photo.jpg"

Parse boundaries with a standards-compliant streaming parser, enforce per-file and total limits, validate content independently of filenames, and store uploads outside executable paths.

Common mistakes

  • Trusting the filename or Content-Type, buffering unbounded bodies, or allowing uploaded content to execute from its storage location.
Permalink: https://merginit.com/reference/http/multipart