File Uploads & Streaming Large Files

[HttpPost("upload")]
public async Task<IActionResult> Upload(IFormFile file) {
    if (file.Length == 0) return BadRequest("Empty file");
    using var stream = file.OpenReadStream();
    await _storageService.SaveAsync(file.FileName, stream);
    return Ok(new { file.FileName, file.Length });
}

Common follow-ups: What's the maximum default upload size, and how do you configure it?;How do you accept multiple files in a single request?

// Buffered approach: entire file loaded before action code runs (problematic for very large files)
[HttpPost]
public async Task<IActionResult> Upload(IFormFile file) { ... }

// Streaming approach: process incrementally without full buffering
[HttpPost]
[DisableFormValueModelBinding]
public async Task<IActionResult> UploadStreamed() {
    var reader = new MultipartReader(boundary, Request.Body);
    var section = await reader.ReadNextSectionAsync();
    // process section.Body as a stream, writing incrementally to storage
}

Common follow-ups: What is DisableFormValueModelBinding and why is it needed for true streaming?;At what file size does buffering actually become a practical problem?

[HttpPost("stream-upload")]
[DisableFormValueModelBinding]
public async Task<IActionResult> StreamUpload() {
    var boundary = MultipartRequestHelper.GetBoundary(MediaTypeHeaderValue.Parse(Request.ContentType));
    var reader = new MultipartReader(boundary, Request.Body);
    var section = await reader.ReadNextSectionAsync();
    while (section != null) {
        var fileSection = section.AsFileSection();
        if (fileSection != null) {
            using var targetStream = File.Create(Path.Combine(_uploadPath, fileSection.FileName));
            await fileSection.FileStream.CopyToAsync(targetStream);
        }
        section = await reader.ReadNextSectionAsync();
    }
    return Ok();
}

Common follow-ups: What's the performance and complexity trade-off of manual streaming versus the simplicity of IFormFile?;How do you validate file type/size during streaming before the entire file has been read?

builder.WebHost.ConfigureKestrel(options => {
    options.Limits.MaxRequestBodySize = 100_000_000;  // 100MB globally
});

[RequestSizeLimit(50_000_000)]  // 50MB override for this specific action
[HttpPost("upload")]
public async Task<IActionResult> Upload(IFormFile file) { ... }

Common follow-ups: How does this limit interact with a reverse proxy (like nginx) that might have its own separate size limit?;What HTTP status code is returned when the limit is exceeded?

[HttpPost("upload-chunk")]
public async Task<IActionResult> UploadChunk(string uploadId, int chunkIndex, int totalChunks, IFormFile chunk) {
    var chunkPath = Path.Combine(_tempPath, uploadId, $"chunk-{chunkIndex}");
    using var stream = File.Create(chunkPath);
    await chunk.CopyToAsync(stream);

    if (await AllChunksReceivedAsync(uploadId, totalChunks)) {
        await AssembleChunksAsync(uploadId, totalChunks);
    }
    return Ok(new { chunkIndex, received = true });
}

Common follow-ups: How do you handle a client that never completes all chunks, leaving orphaned partial uploads?;How does this compare to using a cloud storage provider's native resumable upload API (like Azure Blob's block upload)?

[HttpGet("download/{id}")]
public async Task<IActionResult> Download(int id) {
    var stream = await _storageService.OpenReadStreamAsync(id);
    return File(stream, "application/octet-stream", "report.pdf");
}

// Minimal API equivalent
app.MapGet("/download/{id}", async (int id, IStorageService storage) => {
    var stream = await storage.OpenReadStreamAsync(id);
    return Results.Stream(stream, "application/octet-stream", "report.pdf");
});

Common follow-ups: What's the difference between FileStreamResult and FileContentResult in terms of memory usage?;How does this interact with range requests for resumable downloads?

[HttpGet("video/{id}")]
public async Task<IActionResult> StreamVideo(int id) {
    var stream = await _storageService.OpenSeekableStreamAsync(id);
    return File(stream, "video/mp4", enableRangeProcessing: true);
}

// Client requesting: Range: bytes=1000000-2000000
// Response: 206 Partial Content with just that byte range

Common follow-ups: What server-side stream capabilities are required for range processing to work (seekability)?;How do range requests interact with cloud blob storage's own native range-read support?

public bool IsValidImageFile(Stream stream) {
    var buffer = new byte[8];
    stream.Read(buffer, 0, 8);
    stream.Position = 0;  // reset for later reading
    // PNG magic bytes: 89 50 4E 47 0D 0A 1A 0A
    return buffer[0] == 0x89 && buffer[1] == 0x50 && buffer[2] == 0x4E && buffer[3] == 0x47;
}

Common follow-ups: What other security risks exist for file uploads beyond content type spoofing (path traversal, oversized files)?;How would you scan uploaded files for malware as an additional layer of defense?

[HttpPost("request-upload-url")]
public IActionResult RequestUploadUrl(string fileName) {
    var blobClient = _containerClient.GetBlobClient(fileName);
    var sasUri = blobClient.GenerateSasUri(BlobSasPermissions.Write, DateTimeOffset.UtcNow.AddMinutes(15));
    return Ok(new { uploadUrl = sasUri.ToString() });
}
// Client then uploads the actual file bytes DIRECTLY to sasUri, bypassing the API server entirely

Common follow-ups: How do you validate the uploaded file's properties (size, type) after a direct-to-storage upload, since your API never saw the actual bytes?;What are the security considerations for pre-signed URL expiration and scope?

[HttpPost("upload-multiple")]
public async Task<IActionResult> UploadMultiple(List<IFormFile> files) {
    var results = new List<string>();
    foreach (var file in files) {
        if (file.Length > 0) {
            await _storageService.SaveAsync(file.FileName, file.OpenReadStream());
            results.Add(file.FileName);
        }
    }
    return Ok(new { uploadedFiles = results });
}

Common follow-ups: How would you enforce a maximum number of files per upload request?;What happens if individual files within the batch have wildly different sizes -- does one large file block the others?