topic
Verified 2026-09-18Multipart Requests and Uploads
Multipart media types package multiple parts, commonly form fields and uploaded files, in one HTTP message.
Parse boundaries with a standards-compliant streaming parser, enforce per-file and total limits, validate content independently of filenames, and store uploads outside executable paths.
httpuploadsapisecurity
Reference (http)
Content-Type: multipart/form-data; boundary=example-boundary --example-boundary Content-Disposition: form-data; name="file"; filename="photo.jpg"
Parse boundaries with a standards-compliant streaming parser, enforce per-file and total limits, validate content independently of filenames, and store uploads outside executable paths.
Common mistakes
- Trusting the filename or Content-Type, buffering unbounded bodies, or allowing uploaded content to execute from its storage location.