[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-dotnet-minimal-api-file-upload":3,"mdc-dyxwzp-key":37,"related-repo-dotnet-minimal-api-file-upload":1830,"related-org-dotnet-minimal-api-file-upload":1940},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":32,"sourceUrl":35,"mdContent":36},"minimal-api-file-upload","implement file upload endpoints in ASP.NET","File upload endpoints in ASP.NET minimal APIs (.NET 8+)",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"dotnet",".NET (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fdotnet.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"ASP.NET Core","aspnet-core","tag",{"name":17,"slug":18,"type":15},"Microsoft","microsoft",{"name":20,"slug":21,"type":15},"File Uploads","file-uploads",{"name":23,"slug":24,"type":15},"API Development","api-development",4576,"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fskills","2026-07-12T08:23:12.599178","MIT",332,[31],"agent-skills",{"repoUrl":26,"stars":25,"forks":29,"topics":33,"description":34},[31],"Repository for skills to assist AI coding agents with .NET and C#","https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fdotnet-aspnetcore\u002Fskills\u002Fminimal-api-file-upload","---\nname: minimal-api-file-upload\ndescription: File upload endpoints in ASP.NET minimal APIs (.NET 8+)\nlicense: MIT\n---\n\n# Implementing File Uploads in ASP.NET Core Minimal APIs\n\n## When to Use\n- File upload endpoints in ASP.NET Core minimal APIs (.NET 8+)\n- Handling IFormFile or IFormFileCollection parameters\n- When you need size limits, content type validation, or streaming large files\n\n## When Not to Use\n- MVC controllers → `[FromForm] IFormFile` works directly with attributes\n- Simple JSON body → no file upload needed\n- Very large files (> 1GB) → use streaming with `MultipartReader` instead\n\n## Inputs\n\n| Input | Required | Description |\n|-------|----------|-------------|\n| File parameter(s) | Yes | IFormFile or IFormFileCollection |\n| Size limits | Yes | Max file\u002Frequest size |\n| Allowed types | No | Content type or extension restrictions |\n\n## Workflow\n\n### Step 1: CRITICAL — Understand IFormFile Binding in Minimal APIs\n\n```csharp\n\u002F\u002F In .NET 8+ minimal APIs, IFormFile binds automatically from multipart\u002Fform-data\n\u002F\u002F when it is the only complex parameter.\napp.MapPost(\"\u002Fupload\", (IFormFile file) => ...);\n\n\u002F\u002F CRITICAL: When you mix files with other form fields, use [FromForm] on all\n\u002F\u002F form-bound parameters (or group them into a single [FromForm] DTO).\napp.MapPost(\"\u002Fupload-with-metadata\",\n    ([FromForm] IFormFile file, [FromForm] string description) =>\n{\n    return Results.Ok(new { file.FileName, Description = description });\n});\n\n\u002F\u002F Multiple files: IFormFileCollection also binds automatically from multipart\u002Fform-data.\n\u002F\u002F You only need [FromForm] if you mix it with other form fields, as shown above.\napp.MapPost(\"\u002Fupload-multiple\", (IFormFileCollection files) =>\n{\n    return Results.Ok(files.Select(f => new { f.FileName, f.Length }));\n});\n```\n\n### Step 2: CRITICAL — File Size Limits Are Separate from Request Size Limits\n\n```csharp\n\u002F\u002F CRITICAL: There are TWO different size limits and you need to configure BOTH\n\n\u002F\u002F 1. Request body size limit (Kestrel level) — default is 30MB\nbuilder.WebHost.ConfigureKestrel(options =>\n{\n    options.Limits.MaxRequestBodySize = 10 * 1024 * 1024; \u002F\u002F 10 MB\n});\n\n\u002F\u002F 2. Form options — multipart body length limit — default is 128MB\nbuilder.Services.Configure\u003CFormOptions>(options =>\n{\n    options.MultipartBodyLengthLimit = 10 * 1024 * 1024; \u002F\u002F 10 MB\n    options.ValueLengthLimit = 1024 * 1024; \u002F\u002F 1 MB for form values\n    options.MultipartHeadersLengthLimit = 16384; \u002F\u002F 16 KB for section headers\n});\n\n\u002F\u002F COMMON MISTAKE: Only increasing Kestrel MaxRequestBodySize\n\u002F\u002F upload still fails because FormOptions.MultipartBodyLengthLimit is exceeded\n\n\u002F\u002F COMMON MISTAKE: Only increasing FormOptions\n\u002F\u002F upload fails with \"Request body too large\" from Kestrel before reaching form parsing\n\n\u002F\u002F CRITICAL: Per-endpoint override with RequestSizeLimit attribute\napp.MapPost(\"\u002Fupload-large\", [RequestSizeLimit(200_000_000)] (IFormFile file) =>\n{\n    return Results.Ok(new { file.FileName, file.Length });\n});\n\n\u002F\u002F CRITICAL: To disable the limit entirely (for streaming):\napp.MapPost(\"\u002Fupload-unlimited\", [DisableRequestSizeLimit] async (HttpContext context) =>\n{\n    \u002F\u002F Handle manually\n});\n```\n\n### Step 3: CRITICAL — Anti-Forgery Auto-Validates Form Uploads in .NET 8+\n\n```csharp\n\u002F\u002F CRITICAL: In .NET 8+ with UseAntiforgery(), ALL form-bound endpoints\n\u002F\u002F automatically validate anti-forgery tokens, INCLUDING file uploads\n\nbuilder.Services.AddAntiforgery();\nvar app = builder.Build();\napp.UseAntiforgery();\n\n\u002F\u002F This endpoint now REQUIRES an anti-forgery token:\napp.MapPost(\"\u002Fupload\", (IFormFile file) => Results.Ok(file.FileName));\n\u002F\u002F Without the token → 400 Bad Request\n\n\u002F\u002F CRITICAL: For API-only file uploads (no anti-forgery needed), opt out:\napp.MapPost(\"\u002Fapi\u002Fupload\", (IFormFile file) => Results.Ok(file.FileName))\n    .DisableAntiforgery();  \u002F\u002F CRITICAL: Must explicitly opt out\n\n\u002F\u002F COMMON MISTAKE: Getting 400 errors on file uploads and not realizing\n\u002F\u002F it's because UseAntiforgery() is in the pipeline\n\n\u002F\u002F WARNING: DisableAntiforgery() is safe for unauthenticated endpoints and\n\u002F\u002F endpoints using JWT bearer authentication. However, for endpoints\n\u002F\u002F authenticated with cookies, disabling antiforgery removes CSRF protection\n\u002F\u002F and exposes the endpoint to cross-site request forgery attacks.\n\u002F\u002F For cookie-authenticated endpoints, include a valid antiforgery token instead.\n```\n\n### Step 4: CRITICAL — Validate File Content, Not Just Extension\n\n```csharp\napp.MapPost(\"\u002Fupload\", async (IFormFile file) =>\n{\n    \u002F\u002F CRITICAL: Check content type AND file signature (magic bytes)\n    \u002F\u002F NEVER trust file extension alone — it can be spoofed\n\n    \u002F\u002F Allow only JPEG\u002FPNG by default. To support more (e.g., GIF),\n    \u002F\u002F add the MIME type here AND validate its magic bytes below.\n    var allowedTypes = new[] { \"image\u002Fjpeg\", \"image\u002Fpng\" };\n    if (!allowedTypes.Contains(file.ContentType, StringComparer.OrdinalIgnoreCase))\n        return Results.BadRequest(\"File type not allowed\");\n\n    \u002F\u002F CRITICAL: Check magic bytes for file type verification\n    using var stream = file.OpenReadStream();\n    var header = new byte[8];\n    var bytesRead = await stream.ReadAsync(header, 0, header.Length);\n    if (bytesRead \u003C 4)\n        return Results.BadRequest(\"File content is too short or invalid\");\n\n    \u002F\u002F JPEG: FF D8 FF\n    \u002F\u002F PNG: 89 50 4E 47\n    var isJpeg = header[0] == 0xFF && header[1] == 0xD8 && header[2] == 0xFF;\n    var isPng = header[0] == 0x89 && header[1] == 0x50 && header[2] == 0x4E && header[3] == 0x47;\n\n    \u002F\u002F Determine the actual content type from magic bytes\n    string? detectedContentType = isJpeg ? \"image\u002Fjpeg\" : isPng ? \"image\u002Fpng\" : null;\n    if (detectedContentType is null)\n        return Results.BadRequest(\"File content is not a supported image format (only JPEG and PNG are allowed).\");\n\n    \u002F\u002F Ensure the declared Content-Type matches what the magic bytes detected\n    if (!string.Equals(file.ContentType, detectedContentType, StringComparison.OrdinalIgnoreCase))\n        return Results.BadRequest(\"File content type does not match the declared ContentType header.\");\n\n    \u002F\u002F CRITICAL: Never use the user-provided filename directly for the save path — it can\n    \u002F\u002F contain path traversal characters (e.g., \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\").\n    \u002F\u002F Generate a safe filename; derive the extension from validated content, not user input.\n    var extension = detectedContentType == \"image\u002Fjpeg\" ? \".jpg\" : \".png\";\n    var safeFileName = $\"{Guid.NewGuid()}{extension}\";\n    \u002F\u002F NEVER: var path = Path.Combine(\"uploads\", file.FileName);     \u002F\u002F Path traversal!\n\n    var filePath = Path.Combine(\"uploads\", safeFileName);\n    Directory.CreateDirectory(\"uploads\");\n    stream.Position = 0;\n    using var fileStream = File.Create(filePath);\n    await stream.CopyToAsync(fileStream);\n\n    return Results.Ok(new { FileName = safeFileName, file.Length });\n});\n```\n\n### Step 5: CRITICAL — Streaming Large Files Without Buffering\n\n```csharp\n\u002F\u002F CRITICAL: IFormFile relies on multipart form parsing that buffers content in memory\n\u002F\u002F (up to a threshold) then spills to temp files on disk. For very large uploads,\n\u002F\u002F this overhead is unnecessary if you can process the data in chunks.\n\u002F\u002F Use MultipartReader to stream directly — e.g., to a final storage location —\n\u002F\u002F without buffering the entire file first.\n\napp.MapPost(\"\u002Fupload-stream\",\n    [DisableRequestSizeLimit]\n    async (HttpContext context) =>\n{\n    \u002F\u002F Extract the multipart boundary from the Content-Type header\n    var contentType = context.Request.ContentType;\n    if (contentType == null)\n        return Results.BadRequest(\"Missing Content-Type\");\n\n    \u002F\u002F Safely parse the Content-Type header to avoid FormatException from MediaTypeHeaderValue.Parse\n    if (!MediaTypeHeaderValue.TryParse(contentType, out var mediaType))\n        return Results.BadRequest(\"Invalid Content-Type\");\n\n    var boundary = HeaderUtilities.RemoveQuotes(mediaType.Boundary).Value;\n    if (string.IsNullOrWhiteSpace(boundary))\n        return Results.BadRequest(\"Not a multipart request\");\n\n    var reader = new MultipartReader(boundary, context.Request.Body);\n\n    \u002F\u002F CRITICAL: ReadNextSectionAsync returns null when there are no more sections\n    while (await reader.ReadNextSectionAsync() is { } section)\n    {\n        \u002F\u002F Parse Content-Disposition to identify file sections\n        if (!ContentDispositionHeaderValue.TryParse(section.ContentDisposition, out var contentDisposition))\n            continue;\n\n        if (contentDisposition.DispositionType.Equals(\"form-data\")\n            && !string.IsNullOrEmpty(contentDisposition.FileName.Value))\n        {\n            \u002F\u002F Sanitize the user-provided filename to prevent path traversal\n            var originalFileName = contentDisposition.FileName.Value ?? string.Empty;\n            var sanitizedFileName = Path.GetFileName(originalFileName.Trim('\"'));\n            var safeFile = $\"{Guid.NewGuid()}\";\n\n            \u002F\u002F CRITICAL: Stream directly to disk — avoids buffering in memory\n            Directory.CreateDirectory(\"uploads\");\n            using var fileStream = File.Create(Path.Combine(\"uploads\", safeFile));\n            await section.Body.CopyToAsync(fileStream);\n        }\n    }\n\n    return Results.Ok(\"Uploaded\");\n}).DisableAntiforgery();\n\n\u002F\u002F COMMON MISTAKE: Using IFormFile for very large files\n\u002F\u002F Multipart form parsing can buffer large uploads and consume memory\u002Fdisk.\n\u002F\u002F Use MultipartReader for streaming directly to storage.\n```\n\n## Common Mistakes\n\n1. **Only configuring one size limit**: Must configure BOTH Kestrel `MaxRequestBodySize` AND `FormOptions.MultipartBodyLengthLimit`.\n2. **400 errors from anti-forgery**: In .NET 8+, `UseAntiforgery()` auto-validates form uploads. Use `.DisableAntiforgery()` for API endpoints (safe for JWT\u002Funauthenticated; do NOT disable for cookie-authenticated endpoints).\n3. **Trusting file.FileName**: User-provided filename can contain path traversal. Generate a safe filename with `Guid.NewGuid()` and derive the extension from validated content.\n4. **Trusting Content-Type only**: Content type is client-spoofable. Always check magic bytes for actual file type verification.\n5. **Using IFormFile for very large files**: Multipart form parsing buffers with a memory threshold and spills to temp files. Use `MultipartReader` to stream data in chunks directly to storage without buffering the entire file.\n6. **Deriving file extension from user input**: Prefer deriving the extension from the validated content type or magic bytes rather than `Path.GetExtension(file.FileName)`. If the original extension must be preserved, validate it against the detected content type.\n",{"data":38,"body":39},{"name":4,"description":6,"license":28},{"type":40,"children":41},"root",[42,51,58,78,84,119,125,211,217,224,397,403,675,681,867,873,1265,1271,1698,1704,1824],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"implementing-file-uploads-in-aspnet-core-minimal-apis",[48],{"type":49,"value":50},"text","Implementing File Uploads in ASP.NET Core Minimal APIs",{"type":43,"tag":52,"props":53,"children":55},"h2",{"id":54},"when-to-use",[56],{"type":49,"value":57},"When to Use",{"type":43,"tag":59,"props":60,"children":61},"ul",{},[62,68,73],{"type":43,"tag":63,"props":64,"children":65},"li",{},[66],{"type":49,"value":67},"File upload endpoints in ASP.NET Core minimal APIs (.NET 8+)",{"type":43,"tag":63,"props":69,"children":70},{},[71],{"type":49,"value":72},"Handling IFormFile or IFormFileCollection parameters",{"type":43,"tag":63,"props":74,"children":75},{},[76],{"type":49,"value":77},"When you need size limits, content type validation, or streaming large files",{"type":43,"tag":52,"props":79,"children":81},{"id":80},"when-not-to-use",[82],{"type":49,"value":83},"When Not to Use",{"type":43,"tag":59,"props":85,"children":86},{},[87,101,106],{"type":43,"tag":63,"props":88,"children":89},{},[90,92,99],{"type":49,"value":91},"MVC controllers → ",{"type":43,"tag":93,"props":94,"children":96},"code",{"className":95},[],[97],{"type":49,"value":98},"[FromForm] IFormFile",{"type":49,"value":100}," works directly with attributes",{"type":43,"tag":63,"props":102,"children":103},{},[104],{"type":49,"value":105},"Simple JSON body → no file upload needed",{"type":43,"tag":63,"props":107,"children":108},{},[109,111,117],{"type":49,"value":110},"Very large files (> 1GB) → use streaming with ",{"type":43,"tag":93,"props":112,"children":114},{"className":113},[],[115],{"type":49,"value":116},"MultipartReader",{"type":49,"value":118}," instead",{"type":43,"tag":52,"props":120,"children":122},{"id":121},"inputs",[123],{"type":49,"value":124},"Inputs",{"type":43,"tag":126,"props":127,"children":128},"table",{},[129,153],{"type":43,"tag":130,"props":131,"children":132},"thead",{},[133],{"type":43,"tag":134,"props":135,"children":136},"tr",{},[137,143,148],{"type":43,"tag":138,"props":139,"children":140},"th",{},[141],{"type":49,"value":142},"Input",{"type":43,"tag":138,"props":144,"children":145},{},[146],{"type":49,"value":147},"Required",{"type":43,"tag":138,"props":149,"children":150},{},[151],{"type":49,"value":152},"Description",{"type":43,"tag":154,"props":155,"children":156},"tbody",{},[157,176,193],{"type":43,"tag":134,"props":158,"children":159},{},[160,166,171],{"type":43,"tag":161,"props":162,"children":163},"td",{},[164],{"type":49,"value":165},"File parameter(s)",{"type":43,"tag":161,"props":167,"children":168},{},[169],{"type":49,"value":170},"Yes",{"type":43,"tag":161,"props":172,"children":173},{},[174],{"type":49,"value":175},"IFormFile or IFormFileCollection",{"type":43,"tag":134,"props":177,"children":178},{},[179,184,188],{"type":43,"tag":161,"props":180,"children":181},{},[182],{"type":49,"value":183},"Size limits",{"type":43,"tag":161,"props":185,"children":186},{},[187],{"type":49,"value":170},{"type":43,"tag":161,"props":189,"children":190},{},[191],{"type":49,"value":192},"Max file\u002Frequest size",{"type":43,"tag":134,"props":194,"children":195},{},[196,201,206],{"type":43,"tag":161,"props":197,"children":198},{},[199],{"type":49,"value":200},"Allowed types",{"type":43,"tag":161,"props":202,"children":203},{},[204],{"type":49,"value":205},"No",{"type":43,"tag":161,"props":207,"children":208},{},[209],{"type":49,"value":210},"Content type or extension restrictions",{"type":43,"tag":52,"props":212,"children":214},{"id":213},"workflow",[215],{"type":49,"value":216},"Workflow",{"type":43,"tag":218,"props":219,"children":221},"h3",{"id":220},"step-1-critical-understand-iformfile-binding-in-minimal-apis",[222],{"type":49,"value":223},"Step 1: CRITICAL — Understand IFormFile Binding in Minimal APIs",{"type":43,"tag":225,"props":226,"children":231},"pre",{"className":227,"code":228,"language":229,"meta":230,"style":230},"language-csharp shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F In .NET 8+ minimal APIs, IFormFile binds automatically from multipart\u002Fform-data\n\u002F\u002F when it is the only complex parameter.\napp.MapPost(\"\u002Fupload\", (IFormFile file) => ...);\n\n\u002F\u002F CRITICAL: When you mix files with other form fields, use [FromForm] on all\n\u002F\u002F form-bound parameters (or group them into a single [FromForm] DTO).\napp.MapPost(\"\u002Fupload-with-metadata\",\n    ([FromForm] IFormFile file, [FromForm] string description) =>\n{\n    return Results.Ok(new { file.FileName, Description = description });\n});\n\n\u002F\u002F Multiple files: IFormFileCollection also binds automatically from multipart\u002Fform-data.\n\u002F\u002F You only need [FromForm] if you mix it with other form fields, as shown above.\napp.MapPost(\"\u002Fupload-multiple\", (IFormFileCollection files) =>\n{\n    return Results.Ok(files.Select(f => new { f.FileName, f.Length }));\n});\n","csharp","",[232],{"type":43,"tag":93,"props":233,"children":234},{"__ignoreMap":230},[235,246,255,264,274,283,292,301,310,319,328,337,345,354,363,372,380,389],{"type":43,"tag":236,"props":237,"children":240},"span",{"class":238,"line":239},"line",1,[241],{"type":43,"tag":236,"props":242,"children":243},{},[244],{"type":49,"value":245},"\u002F\u002F In .NET 8+ minimal APIs, IFormFile binds automatically from multipart\u002Fform-data\n",{"type":43,"tag":236,"props":247,"children":249},{"class":238,"line":248},2,[250],{"type":43,"tag":236,"props":251,"children":252},{},[253],{"type":49,"value":254},"\u002F\u002F when it is the only complex parameter.\n",{"type":43,"tag":236,"props":256,"children":258},{"class":238,"line":257},3,[259],{"type":43,"tag":236,"props":260,"children":261},{},[262],{"type":49,"value":263},"app.MapPost(\"\u002Fupload\", (IFormFile file) => ...);\n",{"type":43,"tag":236,"props":265,"children":267},{"class":238,"line":266},4,[268],{"type":43,"tag":236,"props":269,"children":271},{"emptyLinePlaceholder":270},true,[272],{"type":49,"value":273},"\n",{"type":43,"tag":236,"props":275,"children":277},{"class":238,"line":276},5,[278],{"type":43,"tag":236,"props":279,"children":280},{},[281],{"type":49,"value":282},"\u002F\u002F CRITICAL: When you mix files with other form fields, use [FromForm] on all\n",{"type":43,"tag":236,"props":284,"children":286},{"class":238,"line":285},6,[287],{"type":43,"tag":236,"props":288,"children":289},{},[290],{"type":49,"value":291},"\u002F\u002F form-bound parameters (or group them into a single [FromForm] DTO).\n",{"type":43,"tag":236,"props":293,"children":295},{"class":238,"line":294},7,[296],{"type":43,"tag":236,"props":297,"children":298},{},[299],{"type":49,"value":300},"app.MapPost(\"\u002Fupload-with-metadata\",\n",{"type":43,"tag":236,"props":302,"children":304},{"class":238,"line":303},8,[305],{"type":43,"tag":236,"props":306,"children":307},{},[308],{"type":49,"value":309},"    ([FromForm] IFormFile file, [FromForm] string description) =>\n",{"type":43,"tag":236,"props":311,"children":313},{"class":238,"line":312},9,[314],{"type":43,"tag":236,"props":315,"children":316},{},[317],{"type":49,"value":318},"{\n",{"type":43,"tag":236,"props":320,"children":322},{"class":238,"line":321},10,[323],{"type":43,"tag":236,"props":324,"children":325},{},[326],{"type":49,"value":327},"    return Results.Ok(new { file.FileName, Description = description });\n",{"type":43,"tag":236,"props":329,"children":331},{"class":238,"line":330},11,[332],{"type":43,"tag":236,"props":333,"children":334},{},[335],{"type":49,"value":336},"});\n",{"type":43,"tag":236,"props":338,"children":340},{"class":238,"line":339},12,[341],{"type":43,"tag":236,"props":342,"children":343},{"emptyLinePlaceholder":270},[344],{"type":49,"value":273},{"type":43,"tag":236,"props":346,"children":348},{"class":238,"line":347},13,[349],{"type":43,"tag":236,"props":350,"children":351},{},[352],{"type":49,"value":353},"\u002F\u002F Multiple files: IFormFileCollection also binds automatically from multipart\u002Fform-data.\n",{"type":43,"tag":236,"props":355,"children":357},{"class":238,"line":356},14,[358],{"type":43,"tag":236,"props":359,"children":360},{},[361],{"type":49,"value":362},"\u002F\u002F You only need [FromForm] if you mix it with other form fields, as shown above.\n",{"type":43,"tag":236,"props":364,"children":366},{"class":238,"line":365},15,[367],{"type":43,"tag":236,"props":368,"children":369},{},[370],{"type":49,"value":371},"app.MapPost(\"\u002Fupload-multiple\", (IFormFileCollection files) =>\n",{"type":43,"tag":236,"props":373,"children":375},{"class":238,"line":374},16,[376],{"type":43,"tag":236,"props":377,"children":378},{},[379],{"type":49,"value":318},{"type":43,"tag":236,"props":381,"children":383},{"class":238,"line":382},17,[384],{"type":43,"tag":236,"props":385,"children":386},{},[387],{"type":49,"value":388},"    return Results.Ok(files.Select(f => new { f.FileName, f.Length }));\n",{"type":43,"tag":236,"props":390,"children":392},{"class":238,"line":391},18,[393],{"type":43,"tag":236,"props":394,"children":395},{},[396],{"type":49,"value":336},{"type":43,"tag":218,"props":398,"children":400},{"id":399},"step-2-critical-file-size-limits-are-separate-from-request-size-limits",[401],{"type":49,"value":402},"Step 2: CRITICAL — File Size Limits Are Separate from Request Size Limits",{"type":43,"tag":225,"props":404,"children":406},{"className":227,"code":405,"language":229,"meta":230,"style":230},"\u002F\u002F CRITICAL: There are TWO different size limits and you need to configure BOTH\n\n\u002F\u002F 1. Request body size limit (Kestrel level) — default is 30MB\nbuilder.WebHost.ConfigureKestrel(options =>\n{\n    options.Limits.MaxRequestBodySize = 10 * 1024 * 1024; \u002F\u002F 10 MB\n});\n\n\u002F\u002F 2. Form options — multipart body length limit — default is 128MB\nbuilder.Services.Configure\u003CFormOptions>(options =>\n{\n    options.MultipartBodyLengthLimit = 10 * 1024 * 1024; \u002F\u002F 10 MB\n    options.ValueLengthLimit = 1024 * 1024; \u002F\u002F 1 MB for form values\n    options.MultipartHeadersLengthLimit = 16384; \u002F\u002F 16 KB for section headers\n});\n\n\u002F\u002F COMMON MISTAKE: Only increasing Kestrel MaxRequestBodySize\n\u002F\u002F upload still fails because FormOptions.MultipartBodyLengthLimit is exceeded\n\n\u002F\u002F COMMON MISTAKE: Only increasing FormOptions\n\u002F\u002F upload fails with \"Request body too large\" from Kestrel before reaching form parsing\n\n\u002F\u002F CRITICAL: Per-endpoint override with RequestSizeLimit attribute\napp.MapPost(\"\u002Fupload-large\", [RequestSizeLimit(200_000_000)] (IFormFile file) =>\n{\n    return Results.Ok(new { file.FileName, file.Length });\n});\n\n\u002F\u002F CRITICAL: To disable the limit entirely (for streaming):\napp.MapPost(\"\u002Fupload-unlimited\", [DisableRequestSizeLimit] async (HttpContext context) =>\n{\n    \u002F\u002F Handle manually\n});\n",[407],{"type":43,"tag":93,"props":408,"children":409},{"__ignoreMap":230},[410,418,425,433,441,448,456,463,470,478,486,493,501,509,517,524,531,539,547,555,564,573,581,590,599,607,616,624,632,641,650,658,667],{"type":43,"tag":236,"props":411,"children":412},{"class":238,"line":239},[413],{"type":43,"tag":236,"props":414,"children":415},{},[416],{"type":49,"value":417},"\u002F\u002F CRITICAL: There are TWO different size limits and you need to configure BOTH\n",{"type":43,"tag":236,"props":419,"children":420},{"class":238,"line":248},[421],{"type":43,"tag":236,"props":422,"children":423},{"emptyLinePlaceholder":270},[424],{"type":49,"value":273},{"type":43,"tag":236,"props":426,"children":427},{"class":238,"line":257},[428],{"type":43,"tag":236,"props":429,"children":430},{},[431],{"type":49,"value":432},"\u002F\u002F 1. Request body size limit (Kestrel level) — default is 30MB\n",{"type":43,"tag":236,"props":434,"children":435},{"class":238,"line":266},[436],{"type":43,"tag":236,"props":437,"children":438},{},[439],{"type":49,"value":440},"builder.WebHost.ConfigureKestrel(options =>\n",{"type":43,"tag":236,"props":442,"children":443},{"class":238,"line":276},[444],{"type":43,"tag":236,"props":445,"children":446},{},[447],{"type":49,"value":318},{"type":43,"tag":236,"props":449,"children":450},{"class":238,"line":285},[451],{"type":43,"tag":236,"props":452,"children":453},{},[454],{"type":49,"value":455},"    options.Limits.MaxRequestBodySize = 10 * 1024 * 1024; \u002F\u002F 10 MB\n",{"type":43,"tag":236,"props":457,"children":458},{"class":238,"line":294},[459],{"type":43,"tag":236,"props":460,"children":461},{},[462],{"type":49,"value":336},{"type":43,"tag":236,"props":464,"children":465},{"class":238,"line":303},[466],{"type":43,"tag":236,"props":467,"children":468},{"emptyLinePlaceholder":270},[469],{"type":49,"value":273},{"type":43,"tag":236,"props":471,"children":472},{"class":238,"line":312},[473],{"type":43,"tag":236,"props":474,"children":475},{},[476],{"type":49,"value":477},"\u002F\u002F 2. Form options — multipart body length limit — default is 128MB\n",{"type":43,"tag":236,"props":479,"children":480},{"class":238,"line":321},[481],{"type":43,"tag":236,"props":482,"children":483},{},[484],{"type":49,"value":485},"builder.Services.Configure\u003CFormOptions>(options =>\n",{"type":43,"tag":236,"props":487,"children":488},{"class":238,"line":330},[489],{"type":43,"tag":236,"props":490,"children":491},{},[492],{"type":49,"value":318},{"type":43,"tag":236,"props":494,"children":495},{"class":238,"line":339},[496],{"type":43,"tag":236,"props":497,"children":498},{},[499],{"type":49,"value":500},"    options.MultipartBodyLengthLimit = 10 * 1024 * 1024; \u002F\u002F 10 MB\n",{"type":43,"tag":236,"props":502,"children":503},{"class":238,"line":347},[504],{"type":43,"tag":236,"props":505,"children":506},{},[507],{"type":49,"value":508},"    options.ValueLengthLimit = 1024 * 1024; \u002F\u002F 1 MB for form values\n",{"type":43,"tag":236,"props":510,"children":511},{"class":238,"line":356},[512],{"type":43,"tag":236,"props":513,"children":514},{},[515],{"type":49,"value":516},"    options.MultipartHeadersLengthLimit = 16384; \u002F\u002F 16 KB for section headers\n",{"type":43,"tag":236,"props":518,"children":519},{"class":238,"line":365},[520],{"type":43,"tag":236,"props":521,"children":522},{},[523],{"type":49,"value":336},{"type":43,"tag":236,"props":525,"children":526},{"class":238,"line":374},[527],{"type":43,"tag":236,"props":528,"children":529},{"emptyLinePlaceholder":270},[530],{"type":49,"value":273},{"type":43,"tag":236,"props":532,"children":533},{"class":238,"line":382},[534],{"type":43,"tag":236,"props":535,"children":536},{},[537],{"type":49,"value":538},"\u002F\u002F COMMON MISTAKE: Only increasing Kestrel MaxRequestBodySize\n",{"type":43,"tag":236,"props":540,"children":541},{"class":238,"line":391},[542],{"type":43,"tag":236,"props":543,"children":544},{},[545],{"type":49,"value":546},"\u002F\u002F upload still fails because FormOptions.MultipartBodyLengthLimit is exceeded\n",{"type":43,"tag":236,"props":548,"children":550},{"class":238,"line":549},19,[551],{"type":43,"tag":236,"props":552,"children":553},{"emptyLinePlaceholder":270},[554],{"type":49,"value":273},{"type":43,"tag":236,"props":556,"children":558},{"class":238,"line":557},20,[559],{"type":43,"tag":236,"props":560,"children":561},{},[562],{"type":49,"value":563},"\u002F\u002F COMMON MISTAKE: Only increasing FormOptions\n",{"type":43,"tag":236,"props":565,"children":567},{"class":238,"line":566},21,[568],{"type":43,"tag":236,"props":569,"children":570},{},[571],{"type":49,"value":572},"\u002F\u002F upload fails with \"Request body too large\" from Kestrel before reaching form parsing\n",{"type":43,"tag":236,"props":574,"children":576},{"class":238,"line":575},22,[577],{"type":43,"tag":236,"props":578,"children":579},{"emptyLinePlaceholder":270},[580],{"type":49,"value":273},{"type":43,"tag":236,"props":582,"children":584},{"class":238,"line":583},23,[585],{"type":43,"tag":236,"props":586,"children":587},{},[588],{"type":49,"value":589},"\u002F\u002F CRITICAL: Per-endpoint override with RequestSizeLimit attribute\n",{"type":43,"tag":236,"props":591,"children":593},{"class":238,"line":592},24,[594],{"type":43,"tag":236,"props":595,"children":596},{},[597],{"type":49,"value":598},"app.MapPost(\"\u002Fupload-large\", [RequestSizeLimit(200_000_000)] (IFormFile file) =>\n",{"type":43,"tag":236,"props":600,"children":602},{"class":238,"line":601},25,[603],{"type":43,"tag":236,"props":604,"children":605},{},[606],{"type":49,"value":318},{"type":43,"tag":236,"props":608,"children":610},{"class":238,"line":609},26,[611],{"type":43,"tag":236,"props":612,"children":613},{},[614],{"type":49,"value":615},"    return Results.Ok(new { file.FileName, file.Length });\n",{"type":43,"tag":236,"props":617,"children":619},{"class":238,"line":618},27,[620],{"type":43,"tag":236,"props":621,"children":622},{},[623],{"type":49,"value":336},{"type":43,"tag":236,"props":625,"children":627},{"class":238,"line":626},28,[628],{"type":43,"tag":236,"props":629,"children":630},{"emptyLinePlaceholder":270},[631],{"type":49,"value":273},{"type":43,"tag":236,"props":633,"children":635},{"class":238,"line":634},29,[636],{"type":43,"tag":236,"props":637,"children":638},{},[639],{"type":49,"value":640},"\u002F\u002F CRITICAL: To disable the limit entirely (for streaming):\n",{"type":43,"tag":236,"props":642,"children":644},{"class":238,"line":643},30,[645],{"type":43,"tag":236,"props":646,"children":647},{},[648],{"type":49,"value":649},"app.MapPost(\"\u002Fupload-unlimited\", [DisableRequestSizeLimit] async (HttpContext context) =>\n",{"type":43,"tag":236,"props":651,"children":653},{"class":238,"line":652},31,[654],{"type":43,"tag":236,"props":655,"children":656},{},[657],{"type":49,"value":318},{"type":43,"tag":236,"props":659,"children":661},{"class":238,"line":660},32,[662],{"type":43,"tag":236,"props":663,"children":664},{},[665],{"type":49,"value":666},"    \u002F\u002F Handle manually\n",{"type":43,"tag":236,"props":668,"children":670},{"class":238,"line":669},33,[671],{"type":43,"tag":236,"props":672,"children":673},{},[674],{"type":49,"value":336},{"type":43,"tag":218,"props":676,"children":678},{"id":677},"step-3-critical-anti-forgery-auto-validates-form-uploads-in-net-8",[679],{"type":49,"value":680},"Step 3: CRITICAL — Anti-Forgery Auto-Validates Form Uploads in .NET 8+",{"type":43,"tag":225,"props":682,"children":684},{"className":227,"code":683,"language":229,"meta":230,"style":230},"\u002F\u002F CRITICAL: In .NET 8+ with UseAntiforgery(), ALL form-bound endpoints\n\u002F\u002F automatically validate anti-forgery tokens, INCLUDING file uploads\n\nbuilder.Services.AddAntiforgery();\nvar app = builder.Build();\napp.UseAntiforgery();\n\n\u002F\u002F This endpoint now REQUIRES an anti-forgery token:\napp.MapPost(\"\u002Fupload\", (IFormFile file) => Results.Ok(file.FileName));\n\u002F\u002F Without the token → 400 Bad Request\n\n\u002F\u002F CRITICAL: For API-only file uploads (no anti-forgery needed), opt out:\napp.MapPost(\"\u002Fapi\u002Fupload\", (IFormFile file) => Results.Ok(file.FileName))\n    .DisableAntiforgery();  \u002F\u002F CRITICAL: Must explicitly opt out\n\n\u002F\u002F COMMON MISTAKE: Getting 400 errors on file uploads and not realizing\n\u002F\u002F it's because UseAntiforgery() is in the pipeline\n\n\u002F\u002F WARNING: DisableAntiforgery() is safe for unauthenticated endpoints and\n\u002F\u002F endpoints using JWT bearer authentication. However, for endpoints\n\u002F\u002F authenticated with cookies, disabling antiforgery removes CSRF protection\n\u002F\u002F and exposes the endpoint to cross-site request forgery attacks.\n\u002F\u002F For cookie-authenticated endpoints, include a valid antiforgery token instead.\n",[685],{"type":43,"tag":93,"props":686,"children":687},{"__ignoreMap":230},[688,696,704,711,719,727,735,742,750,758,766,773,781,789,797,804,812,820,827,835,843,851,859],{"type":43,"tag":236,"props":689,"children":690},{"class":238,"line":239},[691],{"type":43,"tag":236,"props":692,"children":693},{},[694],{"type":49,"value":695},"\u002F\u002F CRITICAL: In .NET 8+ with UseAntiforgery(), ALL form-bound endpoints\n",{"type":43,"tag":236,"props":697,"children":698},{"class":238,"line":248},[699],{"type":43,"tag":236,"props":700,"children":701},{},[702],{"type":49,"value":703},"\u002F\u002F automatically validate anti-forgery tokens, INCLUDING file uploads\n",{"type":43,"tag":236,"props":705,"children":706},{"class":238,"line":257},[707],{"type":43,"tag":236,"props":708,"children":709},{"emptyLinePlaceholder":270},[710],{"type":49,"value":273},{"type":43,"tag":236,"props":712,"children":713},{"class":238,"line":266},[714],{"type":43,"tag":236,"props":715,"children":716},{},[717],{"type":49,"value":718},"builder.Services.AddAntiforgery();\n",{"type":43,"tag":236,"props":720,"children":721},{"class":238,"line":276},[722],{"type":43,"tag":236,"props":723,"children":724},{},[725],{"type":49,"value":726},"var app = builder.Build();\n",{"type":43,"tag":236,"props":728,"children":729},{"class":238,"line":285},[730],{"type":43,"tag":236,"props":731,"children":732},{},[733],{"type":49,"value":734},"app.UseAntiforgery();\n",{"type":43,"tag":236,"props":736,"children":737},{"class":238,"line":294},[738],{"type":43,"tag":236,"props":739,"children":740},{"emptyLinePlaceholder":270},[741],{"type":49,"value":273},{"type":43,"tag":236,"props":743,"children":744},{"class":238,"line":303},[745],{"type":43,"tag":236,"props":746,"children":747},{},[748],{"type":49,"value":749},"\u002F\u002F This endpoint now REQUIRES an anti-forgery token:\n",{"type":43,"tag":236,"props":751,"children":752},{"class":238,"line":312},[753],{"type":43,"tag":236,"props":754,"children":755},{},[756],{"type":49,"value":757},"app.MapPost(\"\u002Fupload\", (IFormFile file) => Results.Ok(file.FileName));\n",{"type":43,"tag":236,"props":759,"children":760},{"class":238,"line":321},[761],{"type":43,"tag":236,"props":762,"children":763},{},[764],{"type":49,"value":765},"\u002F\u002F Without the token → 400 Bad Request\n",{"type":43,"tag":236,"props":767,"children":768},{"class":238,"line":330},[769],{"type":43,"tag":236,"props":770,"children":771},{"emptyLinePlaceholder":270},[772],{"type":49,"value":273},{"type":43,"tag":236,"props":774,"children":775},{"class":238,"line":339},[776],{"type":43,"tag":236,"props":777,"children":778},{},[779],{"type":49,"value":780},"\u002F\u002F CRITICAL: For API-only file uploads (no anti-forgery needed), opt out:\n",{"type":43,"tag":236,"props":782,"children":783},{"class":238,"line":347},[784],{"type":43,"tag":236,"props":785,"children":786},{},[787],{"type":49,"value":788},"app.MapPost(\"\u002Fapi\u002Fupload\", (IFormFile file) => Results.Ok(file.FileName))\n",{"type":43,"tag":236,"props":790,"children":791},{"class":238,"line":356},[792],{"type":43,"tag":236,"props":793,"children":794},{},[795],{"type":49,"value":796},"    .DisableAntiforgery();  \u002F\u002F CRITICAL: Must explicitly opt out\n",{"type":43,"tag":236,"props":798,"children":799},{"class":238,"line":365},[800],{"type":43,"tag":236,"props":801,"children":802},{"emptyLinePlaceholder":270},[803],{"type":49,"value":273},{"type":43,"tag":236,"props":805,"children":806},{"class":238,"line":374},[807],{"type":43,"tag":236,"props":808,"children":809},{},[810],{"type":49,"value":811},"\u002F\u002F COMMON MISTAKE: Getting 400 errors on file uploads and not realizing\n",{"type":43,"tag":236,"props":813,"children":814},{"class":238,"line":382},[815],{"type":43,"tag":236,"props":816,"children":817},{},[818],{"type":49,"value":819},"\u002F\u002F it's because UseAntiforgery() is in the pipeline\n",{"type":43,"tag":236,"props":821,"children":822},{"class":238,"line":391},[823],{"type":43,"tag":236,"props":824,"children":825},{"emptyLinePlaceholder":270},[826],{"type":49,"value":273},{"type":43,"tag":236,"props":828,"children":829},{"class":238,"line":549},[830],{"type":43,"tag":236,"props":831,"children":832},{},[833],{"type":49,"value":834},"\u002F\u002F WARNING: DisableAntiforgery() is safe for unauthenticated endpoints and\n",{"type":43,"tag":236,"props":836,"children":837},{"class":238,"line":557},[838],{"type":43,"tag":236,"props":839,"children":840},{},[841],{"type":49,"value":842},"\u002F\u002F endpoints using JWT bearer authentication. However, for endpoints\n",{"type":43,"tag":236,"props":844,"children":845},{"class":238,"line":566},[846],{"type":43,"tag":236,"props":847,"children":848},{},[849],{"type":49,"value":850},"\u002F\u002F authenticated with cookies, disabling antiforgery removes CSRF protection\n",{"type":43,"tag":236,"props":852,"children":853},{"class":238,"line":575},[854],{"type":43,"tag":236,"props":855,"children":856},{},[857],{"type":49,"value":858},"\u002F\u002F and exposes the endpoint to cross-site request forgery attacks.\n",{"type":43,"tag":236,"props":860,"children":861},{"class":238,"line":583},[862],{"type":43,"tag":236,"props":863,"children":864},{},[865],{"type":49,"value":866},"\u002F\u002F For cookie-authenticated endpoints, include a valid antiforgery token instead.\n",{"type":43,"tag":218,"props":868,"children":870},{"id":869},"step-4-critical-validate-file-content-not-just-extension",[871],{"type":49,"value":872},"Step 4: CRITICAL — Validate File Content, Not Just Extension",{"type":43,"tag":225,"props":874,"children":876},{"className":227,"code":875,"language":229,"meta":230,"style":230},"app.MapPost(\"\u002Fupload\", async (IFormFile file) =>\n{\n    \u002F\u002F CRITICAL: Check content type AND file signature (magic bytes)\n    \u002F\u002F NEVER trust file extension alone — it can be spoofed\n\n    \u002F\u002F Allow only JPEG\u002FPNG by default. To support more (e.g., GIF),\n    \u002F\u002F add the MIME type here AND validate its magic bytes below.\n    var allowedTypes = new[] { \"image\u002Fjpeg\", \"image\u002Fpng\" };\n    if (!allowedTypes.Contains(file.ContentType, StringComparer.OrdinalIgnoreCase))\n        return Results.BadRequest(\"File type not allowed\");\n\n    \u002F\u002F CRITICAL: Check magic bytes for file type verification\n    using var stream = file.OpenReadStream();\n    var header = new byte[8];\n    var bytesRead = await stream.ReadAsync(header, 0, header.Length);\n    if (bytesRead \u003C 4)\n        return Results.BadRequest(\"File content is too short or invalid\");\n\n    \u002F\u002F JPEG: FF D8 FF\n    \u002F\u002F PNG: 89 50 4E 47\n    var isJpeg = header[0] == 0xFF && header[1] == 0xD8 && header[2] == 0xFF;\n    var isPng = header[0] == 0x89 && header[1] == 0x50 && header[2] == 0x4E && header[3] == 0x47;\n\n    \u002F\u002F Determine the actual content type from magic bytes\n    string? detectedContentType = isJpeg ? \"image\u002Fjpeg\" : isPng ? \"image\u002Fpng\" : null;\n    if (detectedContentType is null)\n        return Results.BadRequest(\"File content is not a supported image format (only JPEG and PNG are allowed).\");\n\n    \u002F\u002F Ensure the declared Content-Type matches what the magic bytes detected\n    if (!string.Equals(file.ContentType, detectedContentType, StringComparison.OrdinalIgnoreCase))\n        return Results.BadRequest(\"File content type does not match the declared ContentType header.\");\n\n    \u002F\u002F CRITICAL: Never use the user-provided filename directly for the save path — it can\n    \u002F\u002F contain path traversal characters (e.g., \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\").\n    \u002F\u002F Generate a safe filename; derive the extension from validated content, not user input.\n    var extension = detectedContentType == \"image\u002Fjpeg\" ? \".jpg\" : \".png\";\n    var safeFileName = $\"{Guid.NewGuid()}{extension}\";\n    \u002F\u002F NEVER: var path = Path.Combine(\"uploads\", file.FileName);     \u002F\u002F Path traversal!\n\n    var filePath = Path.Combine(\"uploads\", safeFileName);\n    Directory.CreateDirectory(\"uploads\");\n    stream.Position = 0;\n    using var fileStream = File.Create(filePath);\n    await stream.CopyToAsync(fileStream);\n\n    return Results.Ok(new { FileName = safeFileName, file.Length });\n});\n",[877],{"type":43,"tag":93,"props":878,"children":879},{"__ignoreMap":230},[880,888,895,903,911,918,926,934,942,950,958,965,973,981,989,997,1005,1013,1020,1028,1036,1044,1052,1059,1067,1075,1083,1091,1098,1106,1114,1122,1129,1137,1146,1155,1164,1173,1187,1195,1204,1213,1222,1231,1240,1248,1257],{"type":43,"tag":236,"props":881,"children":882},{"class":238,"line":239},[883],{"type":43,"tag":236,"props":884,"children":885},{},[886],{"type":49,"value":887},"app.MapPost(\"\u002Fupload\", async (IFormFile file) =>\n",{"type":43,"tag":236,"props":889,"children":890},{"class":238,"line":248},[891],{"type":43,"tag":236,"props":892,"children":893},{},[894],{"type":49,"value":318},{"type":43,"tag":236,"props":896,"children":897},{"class":238,"line":257},[898],{"type":43,"tag":236,"props":899,"children":900},{},[901],{"type":49,"value":902},"    \u002F\u002F CRITICAL: Check content type AND file signature (magic bytes)\n",{"type":43,"tag":236,"props":904,"children":905},{"class":238,"line":266},[906],{"type":43,"tag":236,"props":907,"children":908},{},[909],{"type":49,"value":910},"    \u002F\u002F NEVER trust file extension alone — it can be spoofed\n",{"type":43,"tag":236,"props":912,"children":913},{"class":238,"line":276},[914],{"type":43,"tag":236,"props":915,"children":916},{"emptyLinePlaceholder":270},[917],{"type":49,"value":273},{"type":43,"tag":236,"props":919,"children":920},{"class":238,"line":285},[921],{"type":43,"tag":236,"props":922,"children":923},{},[924],{"type":49,"value":925},"    \u002F\u002F Allow only JPEG\u002FPNG by default. To support more (e.g., GIF),\n",{"type":43,"tag":236,"props":927,"children":928},{"class":238,"line":294},[929],{"type":43,"tag":236,"props":930,"children":931},{},[932],{"type":49,"value":933},"    \u002F\u002F add the MIME type here AND validate its magic bytes below.\n",{"type":43,"tag":236,"props":935,"children":936},{"class":238,"line":303},[937],{"type":43,"tag":236,"props":938,"children":939},{},[940],{"type":49,"value":941},"    var allowedTypes = new[] { \"image\u002Fjpeg\", \"image\u002Fpng\" };\n",{"type":43,"tag":236,"props":943,"children":944},{"class":238,"line":312},[945],{"type":43,"tag":236,"props":946,"children":947},{},[948],{"type":49,"value":949},"    if (!allowedTypes.Contains(file.ContentType, StringComparer.OrdinalIgnoreCase))\n",{"type":43,"tag":236,"props":951,"children":952},{"class":238,"line":321},[953],{"type":43,"tag":236,"props":954,"children":955},{},[956],{"type":49,"value":957},"        return Results.BadRequest(\"File type not allowed\");\n",{"type":43,"tag":236,"props":959,"children":960},{"class":238,"line":330},[961],{"type":43,"tag":236,"props":962,"children":963},{"emptyLinePlaceholder":270},[964],{"type":49,"value":273},{"type":43,"tag":236,"props":966,"children":967},{"class":238,"line":339},[968],{"type":43,"tag":236,"props":969,"children":970},{},[971],{"type":49,"value":972},"    \u002F\u002F CRITICAL: Check magic bytes for file type verification\n",{"type":43,"tag":236,"props":974,"children":975},{"class":238,"line":347},[976],{"type":43,"tag":236,"props":977,"children":978},{},[979],{"type":49,"value":980},"    using var stream = file.OpenReadStream();\n",{"type":43,"tag":236,"props":982,"children":983},{"class":238,"line":356},[984],{"type":43,"tag":236,"props":985,"children":986},{},[987],{"type":49,"value":988},"    var header = new byte[8];\n",{"type":43,"tag":236,"props":990,"children":991},{"class":238,"line":365},[992],{"type":43,"tag":236,"props":993,"children":994},{},[995],{"type":49,"value":996},"    var bytesRead = await stream.ReadAsync(header, 0, header.Length);\n",{"type":43,"tag":236,"props":998,"children":999},{"class":238,"line":374},[1000],{"type":43,"tag":236,"props":1001,"children":1002},{},[1003],{"type":49,"value":1004},"    if (bytesRead \u003C 4)\n",{"type":43,"tag":236,"props":1006,"children":1007},{"class":238,"line":382},[1008],{"type":43,"tag":236,"props":1009,"children":1010},{},[1011],{"type":49,"value":1012},"        return Results.BadRequest(\"File content is too short or invalid\");\n",{"type":43,"tag":236,"props":1014,"children":1015},{"class":238,"line":391},[1016],{"type":43,"tag":236,"props":1017,"children":1018},{"emptyLinePlaceholder":270},[1019],{"type":49,"value":273},{"type":43,"tag":236,"props":1021,"children":1022},{"class":238,"line":549},[1023],{"type":43,"tag":236,"props":1024,"children":1025},{},[1026],{"type":49,"value":1027},"    \u002F\u002F JPEG: FF D8 FF\n",{"type":43,"tag":236,"props":1029,"children":1030},{"class":238,"line":557},[1031],{"type":43,"tag":236,"props":1032,"children":1033},{},[1034],{"type":49,"value":1035},"    \u002F\u002F PNG: 89 50 4E 47\n",{"type":43,"tag":236,"props":1037,"children":1038},{"class":238,"line":566},[1039],{"type":43,"tag":236,"props":1040,"children":1041},{},[1042],{"type":49,"value":1043},"    var isJpeg = header[0] == 0xFF && header[1] == 0xD8 && header[2] == 0xFF;\n",{"type":43,"tag":236,"props":1045,"children":1046},{"class":238,"line":575},[1047],{"type":43,"tag":236,"props":1048,"children":1049},{},[1050],{"type":49,"value":1051},"    var isPng = header[0] == 0x89 && header[1] == 0x50 && header[2] == 0x4E && header[3] == 0x47;\n",{"type":43,"tag":236,"props":1053,"children":1054},{"class":238,"line":583},[1055],{"type":43,"tag":236,"props":1056,"children":1057},{"emptyLinePlaceholder":270},[1058],{"type":49,"value":273},{"type":43,"tag":236,"props":1060,"children":1061},{"class":238,"line":592},[1062],{"type":43,"tag":236,"props":1063,"children":1064},{},[1065],{"type":49,"value":1066},"    \u002F\u002F Determine the actual content type from magic bytes\n",{"type":43,"tag":236,"props":1068,"children":1069},{"class":238,"line":601},[1070],{"type":43,"tag":236,"props":1071,"children":1072},{},[1073],{"type":49,"value":1074},"    string? detectedContentType = isJpeg ? \"image\u002Fjpeg\" : isPng ? \"image\u002Fpng\" : null;\n",{"type":43,"tag":236,"props":1076,"children":1077},{"class":238,"line":609},[1078],{"type":43,"tag":236,"props":1079,"children":1080},{},[1081],{"type":49,"value":1082},"    if (detectedContentType is null)\n",{"type":43,"tag":236,"props":1084,"children":1085},{"class":238,"line":618},[1086],{"type":43,"tag":236,"props":1087,"children":1088},{},[1089],{"type":49,"value":1090},"        return Results.BadRequest(\"File content is not a supported image format (only JPEG and PNG are allowed).\");\n",{"type":43,"tag":236,"props":1092,"children":1093},{"class":238,"line":626},[1094],{"type":43,"tag":236,"props":1095,"children":1096},{"emptyLinePlaceholder":270},[1097],{"type":49,"value":273},{"type":43,"tag":236,"props":1099,"children":1100},{"class":238,"line":634},[1101],{"type":43,"tag":236,"props":1102,"children":1103},{},[1104],{"type":49,"value":1105},"    \u002F\u002F Ensure the declared Content-Type matches what the magic bytes detected\n",{"type":43,"tag":236,"props":1107,"children":1108},{"class":238,"line":643},[1109],{"type":43,"tag":236,"props":1110,"children":1111},{},[1112],{"type":49,"value":1113},"    if (!string.Equals(file.ContentType, detectedContentType, StringComparison.OrdinalIgnoreCase))\n",{"type":43,"tag":236,"props":1115,"children":1116},{"class":238,"line":652},[1117],{"type":43,"tag":236,"props":1118,"children":1119},{},[1120],{"type":49,"value":1121},"        return Results.BadRequest(\"File content type does not match the declared ContentType header.\");\n",{"type":43,"tag":236,"props":1123,"children":1124},{"class":238,"line":660},[1125],{"type":43,"tag":236,"props":1126,"children":1127},{"emptyLinePlaceholder":270},[1128],{"type":49,"value":273},{"type":43,"tag":236,"props":1130,"children":1131},{"class":238,"line":669},[1132],{"type":43,"tag":236,"props":1133,"children":1134},{},[1135],{"type":49,"value":1136},"    \u002F\u002F CRITICAL: Never use the user-provided filename directly for the save path — it can\n",{"type":43,"tag":236,"props":1138,"children":1140},{"class":238,"line":1139},34,[1141],{"type":43,"tag":236,"props":1142,"children":1143},{},[1144],{"type":49,"value":1145},"    \u002F\u002F contain path traversal characters (e.g., \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\").\n",{"type":43,"tag":236,"props":1147,"children":1149},{"class":238,"line":1148},35,[1150],{"type":43,"tag":236,"props":1151,"children":1152},{},[1153],{"type":49,"value":1154},"    \u002F\u002F Generate a safe filename; derive the extension from validated content, not user input.\n",{"type":43,"tag":236,"props":1156,"children":1158},{"class":238,"line":1157},36,[1159],{"type":43,"tag":236,"props":1160,"children":1161},{},[1162],{"type":49,"value":1163},"    var extension = detectedContentType == \"image\u002Fjpeg\" ? \".jpg\" : \".png\";\n",{"type":43,"tag":236,"props":1165,"children":1167},{"class":238,"line":1166},37,[1168],{"type":43,"tag":236,"props":1169,"children":1170},{},[1171],{"type":49,"value":1172},"    var safeFileName = $\"{Guid.NewGuid()}{extension}\";\n",{"type":43,"tag":236,"props":1174,"children":1176},{"class":238,"line":1175},38,[1177,1182],{"type":43,"tag":236,"props":1178,"children":1179},{},[1180],{"type":49,"value":1181},"    \u002F\u002F NEVER: var path = Path.Combine(\"uploads\", file.FileName);",{"type":43,"tag":236,"props":1183,"children":1184},{},[1185],{"type":49,"value":1186},"     \u002F\u002F Path traversal!\n",{"type":43,"tag":236,"props":1188,"children":1190},{"class":238,"line":1189},39,[1191],{"type":43,"tag":236,"props":1192,"children":1193},{"emptyLinePlaceholder":270},[1194],{"type":49,"value":273},{"type":43,"tag":236,"props":1196,"children":1198},{"class":238,"line":1197},40,[1199],{"type":43,"tag":236,"props":1200,"children":1201},{},[1202],{"type":49,"value":1203},"    var filePath = Path.Combine(\"uploads\", safeFileName);\n",{"type":43,"tag":236,"props":1205,"children":1207},{"class":238,"line":1206},41,[1208],{"type":43,"tag":236,"props":1209,"children":1210},{},[1211],{"type":49,"value":1212},"    Directory.CreateDirectory(\"uploads\");\n",{"type":43,"tag":236,"props":1214,"children":1216},{"class":238,"line":1215},42,[1217],{"type":43,"tag":236,"props":1218,"children":1219},{},[1220],{"type":49,"value":1221},"    stream.Position = 0;\n",{"type":43,"tag":236,"props":1223,"children":1225},{"class":238,"line":1224},43,[1226],{"type":43,"tag":236,"props":1227,"children":1228},{},[1229],{"type":49,"value":1230},"    using var fileStream = File.Create(filePath);\n",{"type":43,"tag":236,"props":1232,"children":1234},{"class":238,"line":1233},44,[1235],{"type":43,"tag":236,"props":1236,"children":1237},{},[1238],{"type":49,"value":1239},"    await stream.CopyToAsync(fileStream);\n",{"type":43,"tag":236,"props":1241,"children":1243},{"class":238,"line":1242},45,[1244],{"type":43,"tag":236,"props":1245,"children":1246},{"emptyLinePlaceholder":270},[1247],{"type":49,"value":273},{"type":43,"tag":236,"props":1249,"children":1251},{"class":238,"line":1250},46,[1252],{"type":43,"tag":236,"props":1253,"children":1254},{},[1255],{"type":49,"value":1256},"    return Results.Ok(new { FileName = safeFileName, file.Length });\n",{"type":43,"tag":236,"props":1258,"children":1260},{"class":238,"line":1259},47,[1261],{"type":43,"tag":236,"props":1262,"children":1263},{},[1264],{"type":49,"value":336},{"type":43,"tag":218,"props":1266,"children":1268},{"id":1267},"step-5-critical-streaming-large-files-without-buffering",[1269],{"type":49,"value":1270},"Step 5: CRITICAL — Streaming Large Files Without Buffering",{"type":43,"tag":225,"props":1272,"children":1274},{"className":227,"code":1273,"language":229,"meta":230,"style":230},"\u002F\u002F CRITICAL: IFormFile relies on multipart form parsing that buffers content in memory\n\u002F\u002F (up to a threshold) then spills to temp files on disk. For very large uploads,\n\u002F\u002F this overhead is unnecessary if you can process the data in chunks.\n\u002F\u002F Use MultipartReader to stream directly — e.g., to a final storage location —\n\u002F\u002F without buffering the entire file first.\n\napp.MapPost(\"\u002Fupload-stream\",\n    [DisableRequestSizeLimit]\n    async (HttpContext context) =>\n{\n    \u002F\u002F Extract the multipart boundary from the Content-Type header\n    var contentType = context.Request.ContentType;\n    if (contentType == null)\n        return Results.BadRequest(\"Missing Content-Type\");\n\n    \u002F\u002F Safely parse the Content-Type header to avoid FormatException from MediaTypeHeaderValue.Parse\n    if (!MediaTypeHeaderValue.TryParse(contentType, out var mediaType))\n        return Results.BadRequest(\"Invalid Content-Type\");\n\n    var boundary = HeaderUtilities.RemoveQuotes(mediaType.Boundary).Value;\n    if (string.IsNullOrWhiteSpace(boundary))\n        return Results.BadRequest(\"Not a multipart request\");\n\n    var reader = new MultipartReader(boundary, context.Request.Body);\n\n    \u002F\u002F CRITICAL: ReadNextSectionAsync returns null when there are no more sections\n    while (await reader.ReadNextSectionAsync() is { } section)\n    {\n        \u002F\u002F Parse Content-Disposition to identify file sections\n        if (!ContentDispositionHeaderValue.TryParse(section.ContentDisposition, out var contentDisposition))\n            continue;\n\n        if (contentDisposition.DispositionType.Equals(\"form-data\")\n            && !string.IsNullOrEmpty(contentDisposition.FileName.Value))\n        {\n            \u002F\u002F Sanitize the user-provided filename to prevent path traversal\n            var originalFileName = contentDisposition.FileName.Value ?? string.Empty;\n            var sanitizedFileName = Path.GetFileName(originalFileName.Trim('\"'));\n            var safeFile = $\"{Guid.NewGuid()}\";\n\n            \u002F\u002F CRITICAL: Stream directly to disk — avoids buffering in memory\n            Directory.CreateDirectory(\"uploads\");\n            using var fileStream = File.Create(Path.Combine(\"uploads\", safeFile));\n            await section.Body.CopyToAsync(fileStream);\n        }\n    }\n\n    return Results.Ok(\"Uploaded\");\n}).DisableAntiforgery();\n\n\u002F\u002F COMMON MISTAKE: Using IFormFile for very large files\n\u002F\u002F Multipart form parsing can buffer large uploads and consume memory\u002Fdisk.\n\u002F\u002F Use MultipartReader for streaming directly to storage.\n",[1275],{"type":43,"tag":93,"props":1276,"children":1277},{"__ignoreMap":230},[1278,1286,1294,1302,1310,1318,1325,1333,1341,1349,1356,1364,1372,1380,1388,1395,1403,1411,1419,1426,1434,1442,1450,1457,1465,1472,1480,1488,1496,1504,1512,1520,1527,1535,1543,1551,1559,1567,1575,1583,1590,1598,1606,1614,1622,1630,1638,1645,1654,1663,1671,1680,1689],{"type":43,"tag":236,"props":1279,"children":1280},{"class":238,"line":239},[1281],{"type":43,"tag":236,"props":1282,"children":1283},{},[1284],{"type":49,"value":1285},"\u002F\u002F CRITICAL: IFormFile relies on multipart form parsing that buffers content in memory\n",{"type":43,"tag":236,"props":1287,"children":1288},{"class":238,"line":248},[1289],{"type":43,"tag":236,"props":1290,"children":1291},{},[1292],{"type":49,"value":1293},"\u002F\u002F (up to a threshold) then spills to temp files on disk. For very large uploads,\n",{"type":43,"tag":236,"props":1295,"children":1296},{"class":238,"line":257},[1297],{"type":43,"tag":236,"props":1298,"children":1299},{},[1300],{"type":49,"value":1301},"\u002F\u002F this overhead is unnecessary if you can process the data in chunks.\n",{"type":43,"tag":236,"props":1303,"children":1304},{"class":238,"line":266},[1305],{"type":43,"tag":236,"props":1306,"children":1307},{},[1308],{"type":49,"value":1309},"\u002F\u002F Use MultipartReader to stream directly — e.g., to a final storage location —\n",{"type":43,"tag":236,"props":1311,"children":1312},{"class":238,"line":276},[1313],{"type":43,"tag":236,"props":1314,"children":1315},{},[1316],{"type":49,"value":1317},"\u002F\u002F without buffering the entire file first.\n",{"type":43,"tag":236,"props":1319,"children":1320},{"class":238,"line":285},[1321],{"type":43,"tag":236,"props":1322,"children":1323},{"emptyLinePlaceholder":270},[1324],{"type":49,"value":273},{"type":43,"tag":236,"props":1326,"children":1327},{"class":238,"line":294},[1328],{"type":43,"tag":236,"props":1329,"children":1330},{},[1331],{"type":49,"value":1332},"app.MapPost(\"\u002Fupload-stream\",\n",{"type":43,"tag":236,"props":1334,"children":1335},{"class":238,"line":303},[1336],{"type":43,"tag":236,"props":1337,"children":1338},{},[1339],{"type":49,"value":1340},"    [DisableRequestSizeLimit]\n",{"type":43,"tag":236,"props":1342,"children":1343},{"class":238,"line":312},[1344],{"type":43,"tag":236,"props":1345,"children":1346},{},[1347],{"type":49,"value":1348},"    async (HttpContext context) =>\n",{"type":43,"tag":236,"props":1350,"children":1351},{"class":238,"line":321},[1352],{"type":43,"tag":236,"props":1353,"children":1354},{},[1355],{"type":49,"value":318},{"type":43,"tag":236,"props":1357,"children":1358},{"class":238,"line":330},[1359],{"type":43,"tag":236,"props":1360,"children":1361},{},[1362],{"type":49,"value":1363},"    \u002F\u002F Extract the multipart boundary from the Content-Type header\n",{"type":43,"tag":236,"props":1365,"children":1366},{"class":238,"line":339},[1367],{"type":43,"tag":236,"props":1368,"children":1369},{},[1370],{"type":49,"value":1371},"    var contentType = context.Request.ContentType;\n",{"type":43,"tag":236,"props":1373,"children":1374},{"class":238,"line":347},[1375],{"type":43,"tag":236,"props":1376,"children":1377},{},[1378],{"type":49,"value":1379},"    if (contentType == null)\n",{"type":43,"tag":236,"props":1381,"children":1382},{"class":238,"line":356},[1383],{"type":43,"tag":236,"props":1384,"children":1385},{},[1386],{"type":49,"value":1387},"        return Results.BadRequest(\"Missing Content-Type\");\n",{"type":43,"tag":236,"props":1389,"children":1390},{"class":238,"line":365},[1391],{"type":43,"tag":236,"props":1392,"children":1393},{"emptyLinePlaceholder":270},[1394],{"type":49,"value":273},{"type":43,"tag":236,"props":1396,"children":1397},{"class":238,"line":374},[1398],{"type":43,"tag":236,"props":1399,"children":1400},{},[1401],{"type":49,"value":1402},"    \u002F\u002F Safely parse the Content-Type header to avoid FormatException from MediaTypeHeaderValue.Parse\n",{"type":43,"tag":236,"props":1404,"children":1405},{"class":238,"line":382},[1406],{"type":43,"tag":236,"props":1407,"children":1408},{},[1409],{"type":49,"value":1410},"    if (!MediaTypeHeaderValue.TryParse(contentType, out var mediaType))\n",{"type":43,"tag":236,"props":1412,"children":1413},{"class":238,"line":391},[1414],{"type":43,"tag":236,"props":1415,"children":1416},{},[1417],{"type":49,"value":1418},"        return Results.BadRequest(\"Invalid Content-Type\");\n",{"type":43,"tag":236,"props":1420,"children":1421},{"class":238,"line":549},[1422],{"type":43,"tag":236,"props":1423,"children":1424},{"emptyLinePlaceholder":270},[1425],{"type":49,"value":273},{"type":43,"tag":236,"props":1427,"children":1428},{"class":238,"line":557},[1429],{"type":43,"tag":236,"props":1430,"children":1431},{},[1432],{"type":49,"value":1433},"    var boundary = HeaderUtilities.RemoveQuotes(mediaType.Boundary).Value;\n",{"type":43,"tag":236,"props":1435,"children":1436},{"class":238,"line":566},[1437],{"type":43,"tag":236,"props":1438,"children":1439},{},[1440],{"type":49,"value":1441},"    if (string.IsNullOrWhiteSpace(boundary))\n",{"type":43,"tag":236,"props":1443,"children":1444},{"class":238,"line":575},[1445],{"type":43,"tag":236,"props":1446,"children":1447},{},[1448],{"type":49,"value":1449},"        return Results.BadRequest(\"Not a multipart request\");\n",{"type":43,"tag":236,"props":1451,"children":1452},{"class":238,"line":583},[1453],{"type":43,"tag":236,"props":1454,"children":1455},{"emptyLinePlaceholder":270},[1456],{"type":49,"value":273},{"type":43,"tag":236,"props":1458,"children":1459},{"class":238,"line":592},[1460],{"type":43,"tag":236,"props":1461,"children":1462},{},[1463],{"type":49,"value":1464},"    var reader = new MultipartReader(boundary, context.Request.Body);\n",{"type":43,"tag":236,"props":1466,"children":1467},{"class":238,"line":601},[1468],{"type":43,"tag":236,"props":1469,"children":1470},{"emptyLinePlaceholder":270},[1471],{"type":49,"value":273},{"type":43,"tag":236,"props":1473,"children":1474},{"class":238,"line":609},[1475],{"type":43,"tag":236,"props":1476,"children":1477},{},[1478],{"type":49,"value":1479},"    \u002F\u002F CRITICAL: ReadNextSectionAsync returns null when there are no more sections\n",{"type":43,"tag":236,"props":1481,"children":1482},{"class":238,"line":618},[1483],{"type":43,"tag":236,"props":1484,"children":1485},{},[1486],{"type":49,"value":1487},"    while (await reader.ReadNextSectionAsync() is { } section)\n",{"type":43,"tag":236,"props":1489,"children":1490},{"class":238,"line":626},[1491],{"type":43,"tag":236,"props":1492,"children":1493},{},[1494],{"type":49,"value":1495},"    {\n",{"type":43,"tag":236,"props":1497,"children":1498},{"class":238,"line":634},[1499],{"type":43,"tag":236,"props":1500,"children":1501},{},[1502],{"type":49,"value":1503},"        \u002F\u002F Parse Content-Disposition to identify file sections\n",{"type":43,"tag":236,"props":1505,"children":1506},{"class":238,"line":643},[1507],{"type":43,"tag":236,"props":1508,"children":1509},{},[1510],{"type":49,"value":1511},"        if (!ContentDispositionHeaderValue.TryParse(section.ContentDisposition, out var contentDisposition))\n",{"type":43,"tag":236,"props":1513,"children":1514},{"class":238,"line":652},[1515],{"type":43,"tag":236,"props":1516,"children":1517},{},[1518],{"type":49,"value":1519},"            continue;\n",{"type":43,"tag":236,"props":1521,"children":1522},{"class":238,"line":660},[1523],{"type":43,"tag":236,"props":1524,"children":1525},{"emptyLinePlaceholder":270},[1526],{"type":49,"value":273},{"type":43,"tag":236,"props":1528,"children":1529},{"class":238,"line":669},[1530],{"type":43,"tag":236,"props":1531,"children":1532},{},[1533],{"type":49,"value":1534},"        if (contentDisposition.DispositionType.Equals(\"form-data\")\n",{"type":43,"tag":236,"props":1536,"children":1537},{"class":238,"line":1139},[1538],{"type":43,"tag":236,"props":1539,"children":1540},{},[1541],{"type":49,"value":1542},"            && !string.IsNullOrEmpty(contentDisposition.FileName.Value))\n",{"type":43,"tag":236,"props":1544,"children":1545},{"class":238,"line":1148},[1546],{"type":43,"tag":236,"props":1547,"children":1548},{},[1549],{"type":49,"value":1550},"        {\n",{"type":43,"tag":236,"props":1552,"children":1553},{"class":238,"line":1157},[1554],{"type":43,"tag":236,"props":1555,"children":1556},{},[1557],{"type":49,"value":1558},"            \u002F\u002F Sanitize the user-provided filename to prevent path traversal\n",{"type":43,"tag":236,"props":1560,"children":1561},{"class":238,"line":1166},[1562],{"type":43,"tag":236,"props":1563,"children":1564},{},[1565],{"type":49,"value":1566},"            var originalFileName = contentDisposition.FileName.Value ?? string.Empty;\n",{"type":43,"tag":236,"props":1568,"children":1569},{"class":238,"line":1175},[1570],{"type":43,"tag":236,"props":1571,"children":1572},{},[1573],{"type":49,"value":1574},"            var sanitizedFileName = Path.GetFileName(originalFileName.Trim('\"'));\n",{"type":43,"tag":236,"props":1576,"children":1577},{"class":238,"line":1189},[1578],{"type":43,"tag":236,"props":1579,"children":1580},{},[1581],{"type":49,"value":1582},"            var safeFile = $\"{Guid.NewGuid()}\";\n",{"type":43,"tag":236,"props":1584,"children":1585},{"class":238,"line":1197},[1586],{"type":43,"tag":236,"props":1587,"children":1588},{"emptyLinePlaceholder":270},[1589],{"type":49,"value":273},{"type":43,"tag":236,"props":1591,"children":1592},{"class":238,"line":1206},[1593],{"type":43,"tag":236,"props":1594,"children":1595},{},[1596],{"type":49,"value":1597},"            \u002F\u002F CRITICAL: Stream directly to disk — avoids buffering in memory\n",{"type":43,"tag":236,"props":1599,"children":1600},{"class":238,"line":1215},[1601],{"type":43,"tag":236,"props":1602,"children":1603},{},[1604],{"type":49,"value":1605},"            Directory.CreateDirectory(\"uploads\");\n",{"type":43,"tag":236,"props":1607,"children":1608},{"class":238,"line":1224},[1609],{"type":43,"tag":236,"props":1610,"children":1611},{},[1612],{"type":49,"value":1613},"            using var fileStream = File.Create(Path.Combine(\"uploads\", safeFile));\n",{"type":43,"tag":236,"props":1615,"children":1616},{"class":238,"line":1233},[1617],{"type":43,"tag":236,"props":1618,"children":1619},{},[1620],{"type":49,"value":1621},"            await section.Body.CopyToAsync(fileStream);\n",{"type":43,"tag":236,"props":1623,"children":1624},{"class":238,"line":1242},[1625],{"type":43,"tag":236,"props":1626,"children":1627},{},[1628],{"type":49,"value":1629},"        }\n",{"type":43,"tag":236,"props":1631,"children":1632},{"class":238,"line":1250},[1633],{"type":43,"tag":236,"props":1634,"children":1635},{},[1636],{"type":49,"value":1637},"    }\n",{"type":43,"tag":236,"props":1639,"children":1640},{"class":238,"line":1259},[1641],{"type":43,"tag":236,"props":1642,"children":1643},{"emptyLinePlaceholder":270},[1644],{"type":49,"value":273},{"type":43,"tag":236,"props":1646,"children":1648},{"class":238,"line":1647},48,[1649],{"type":43,"tag":236,"props":1650,"children":1651},{},[1652],{"type":49,"value":1653},"    return Results.Ok(\"Uploaded\");\n",{"type":43,"tag":236,"props":1655,"children":1657},{"class":238,"line":1656},49,[1658],{"type":43,"tag":236,"props":1659,"children":1660},{},[1661],{"type":49,"value":1662},"}).DisableAntiforgery();\n",{"type":43,"tag":236,"props":1664,"children":1666},{"class":238,"line":1665},50,[1667],{"type":43,"tag":236,"props":1668,"children":1669},{"emptyLinePlaceholder":270},[1670],{"type":49,"value":273},{"type":43,"tag":236,"props":1672,"children":1674},{"class":238,"line":1673},51,[1675],{"type":43,"tag":236,"props":1676,"children":1677},{},[1678],{"type":49,"value":1679},"\u002F\u002F COMMON MISTAKE: Using IFormFile for very large files\n",{"type":43,"tag":236,"props":1681,"children":1683},{"class":238,"line":1682},52,[1684],{"type":43,"tag":236,"props":1685,"children":1686},{},[1687],{"type":49,"value":1688},"\u002F\u002F Multipart form parsing can buffer large uploads and consume memory\u002Fdisk.\n",{"type":43,"tag":236,"props":1690,"children":1692},{"class":238,"line":1691},53,[1693],{"type":43,"tag":236,"props":1694,"children":1695},{},[1696],{"type":49,"value":1697},"\u002F\u002F Use MultipartReader for streaming directly to storage.\n",{"type":43,"tag":52,"props":1699,"children":1701},{"id":1700},"common-mistakes",[1702],{"type":49,"value":1703},"Common Mistakes",{"type":43,"tag":1705,"props":1706,"children":1707},"ol",{},[1708,1735,1761,1779,1789,1806],{"type":43,"tag":63,"props":1709,"children":1710},{},[1711,1717,1719,1725,1727,1733],{"type":43,"tag":1712,"props":1713,"children":1714},"strong",{},[1715],{"type":49,"value":1716},"Only configuring one size limit",{"type":49,"value":1718},": Must configure BOTH Kestrel ",{"type":43,"tag":93,"props":1720,"children":1722},{"className":1721},[],[1723],{"type":49,"value":1724},"MaxRequestBodySize",{"type":49,"value":1726}," AND ",{"type":43,"tag":93,"props":1728,"children":1730},{"className":1729},[],[1731],{"type":49,"value":1732},"FormOptions.MultipartBodyLengthLimit",{"type":49,"value":1734},".",{"type":43,"tag":63,"props":1736,"children":1737},{},[1738,1743,1745,1751,1753,1759],{"type":43,"tag":1712,"props":1739,"children":1740},{},[1741],{"type":49,"value":1742},"400 errors from anti-forgery",{"type":49,"value":1744},": In .NET 8+, ",{"type":43,"tag":93,"props":1746,"children":1748},{"className":1747},[],[1749],{"type":49,"value":1750},"UseAntiforgery()",{"type":49,"value":1752}," auto-validates form uploads. Use ",{"type":43,"tag":93,"props":1754,"children":1756},{"className":1755},[],[1757],{"type":49,"value":1758},".DisableAntiforgery()",{"type":49,"value":1760}," for API endpoints (safe for JWT\u002Funauthenticated; do NOT disable for cookie-authenticated endpoints).",{"type":43,"tag":63,"props":1762,"children":1763},{},[1764,1769,1771,1777],{"type":43,"tag":1712,"props":1765,"children":1766},{},[1767],{"type":49,"value":1768},"Trusting file.FileName",{"type":49,"value":1770},": User-provided filename can contain path traversal. Generate a safe filename with ",{"type":43,"tag":93,"props":1772,"children":1774},{"className":1773},[],[1775],{"type":49,"value":1776},"Guid.NewGuid()",{"type":49,"value":1778}," and derive the extension from validated content.",{"type":43,"tag":63,"props":1780,"children":1781},{},[1782,1787],{"type":43,"tag":1712,"props":1783,"children":1784},{},[1785],{"type":49,"value":1786},"Trusting Content-Type only",{"type":49,"value":1788},": Content type is client-spoofable. Always check magic bytes for actual file type verification.",{"type":43,"tag":63,"props":1790,"children":1791},{},[1792,1797,1799,1804],{"type":43,"tag":1712,"props":1793,"children":1794},{},[1795],{"type":49,"value":1796},"Using IFormFile for very large files",{"type":49,"value":1798},": Multipart form parsing buffers with a memory threshold and spills to temp files. Use ",{"type":43,"tag":93,"props":1800,"children":1802},{"className":1801},[],[1803],{"type":49,"value":116},{"type":49,"value":1805}," to stream data in chunks directly to storage without buffering the entire file.",{"type":43,"tag":63,"props":1807,"children":1808},{},[1809,1814,1816,1822],{"type":43,"tag":1712,"props":1810,"children":1811},{},[1812],{"type":49,"value":1813},"Deriving file extension from user input",{"type":49,"value":1815},": Prefer deriving the extension from the validated content type or magic bytes rather than ",{"type":43,"tag":93,"props":1817,"children":1819},{"className":1818},[],[1820],{"type":49,"value":1821},"Path.GetExtension(file.FileName)",{"type":49,"value":1823},". If the original extension must be preserved, validate it against the detected content type.",{"type":43,"tag":1825,"props":1826,"children":1827},"style",{},[1828],{"type":49,"value":1829},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1831,"total":1939},[1832,1851,1864,1882,1896,1915,1925],{"slug":1833,"name":1833,"fn":1834,"description":1835,"org":1836,"tags":1837,"stars":25,"repoUrl":26,"updatedAt":1850},"analyzing-dotnet-performance","analyze .NET code for performance anti-patterns","Scans .NET code for ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex, serialization, and I\u002FO with tiered severity classification. Use when analyzing .NET code for optimization opportunities, reviewing hot paths, or auditing allocation-heavy patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1838,1841,1844,1847],{"name":1839,"slug":1840,"type":15},".NET","net",{"name":1842,"slug":1843,"type":15},"Code Analysis","code-analysis",{"name":1845,"slug":1846,"type":15},"Debugging","debugging",{"name":1848,"slug":1849,"type":15},"Performance","performance","2026-07-12T08:23:25.400375",{"slug":1852,"name":1852,"fn":1853,"description":1854,"org":1855,"tags":1856,"stars":25,"repoUrl":26,"updatedAt":1863},"android-tombstone-symbolication","symbolicate .NET runtime frames in Android tombstones","Symbolicate the .NET runtime frames in an Android tombstone file. Extracts BuildIds and PC offsets from the native backtrace, downloads debug symbols from the Microsoft symbol server, and runs llvm-symbolizer to produce function names with source file and line numbers. USE FOR triaging a .NET MAUI or Mono Android app crash from a tombstone, resolving native backtrace frames in libmonosgen-2.0.so or libcoreclr.so to .NET runtime source code, or investigating SIGABRT, SIGSEGV, or other native signals originating from the .NET runtime on Android. DO NOT USE FOR pure Java\u002FKotlin crashes, managed .NET exceptions that are already captured in logcat, or iOS crash logs. INVOKES Symbolicate-Tombstone.ps1 script, llvm-symbolizer, Microsoft symbol server.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1857,1858,1861,1862],{"name":1839,"slug":1840,"type":15},{"name":1859,"slug":1860,"type":15},"Android","android",{"name":1845,"slug":1846,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T08:23:21.595572",{"slug":1865,"name":1865,"fn":1866,"description":1867,"org":1868,"tags":1869,"stars":25,"repoUrl":26,"updatedAt":1881},"apple-crash-symbolication","symbolicate .NET runtime frames in crash logs","Symbolicate .NET runtime frames in Apple platform .ips crash logs (iOS, tvOS, Mac Catalyst, macOS). Extracts UUIDs and addresses from the native backtrace, locates dSYM debug symbols, and runs atos to produce function names with source file and line numbers. Automatically downloads .dwarf symbols from the Microsoft symbol server using Mach-O UUIDs. USE FOR triaging a .NET MAUI or Mono app crash from an .ips file on any Apple platform, resolving native backtrace frames in libcoreclr or libmonosgen-2.0 to .NET runtime source code, retrieving .ips crash logs from a connected iOS device or iPhone, or investigating EXC_CRASH, EXC_BAD_ACCESS, SIGABRT, or SIGSEGV originating from the .NET runtime. DO NOT USE FOR pure Swift\u002FObjective-C crashes with no .NET components, or Android tombstone files. INVOKES Symbolicate-Crash.ps1 script, atos, dwarfdump, idevicecrashreport.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1870,1871,1872,1875,1878],{"name":1839,"slug":1840,"type":15},{"name":1845,"slug":1846,"type":15},{"name":1873,"slug":1874,"type":15},"iOS","ios",{"name":1876,"slug":1877,"type":15},"macOS","macos",{"name":1879,"slug":1880,"type":15},"Observability","observability","2026-07-12T08:23:20.369986",{"slug":1883,"name":1883,"fn":1884,"description":1885,"org":1886,"tags":1887,"stars":25,"repoUrl":26,"updatedAt":1895},"assertion-quality","evaluate assertion quality in test suites","Analyzes the variety and depth of assertions across test suites in any language. Use when the user asks to evaluate assertion quality, find shallow tests, identify assertion-free tests (no assertions or only trivial ones like Assert.IsNotNull \u002F toBeTruthy()), flag self-referential or tautological assertions, measure assertion diversity, or audit whether tests verify different facets of behavior. Polyglot: .NET, Python, TS\u002FJS, Java, Go, Ruby, Rust, Swift, Kotlin, PowerShell, C++. DO NOT USE FOR: writing new tests (use code-testing-agent \u002F writing-mstest-tests), mutation reasoning about whether tests would catch a bug (use test-gap-analysis), or a general severity-ranked anti-pattern audit (use test-anti-patterns), fixing or rewriting assertions, or writing, fixing, or modernizing MSTest tests, assertions, or attributes (use writing-mstest-tests).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1888,1889,1892],{"name":1842,"slug":1843,"type":15},{"name":1890,"slug":1891,"type":15},"QA","qa",{"name":1893,"slug":1894,"type":15},"Testing","testing","2026-07-12T08:23:51.277743",{"slug":1897,"name":1897,"fn":1898,"description":1899,"org":1900,"tags":1901,"stars":25,"repoUrl":26,"updatedAt":1914},"author-component","create and review Blazor components","Create or review Blazor components (.razor files) with correct architecture. USE FOR: writing new Blazor components that do NOT involve JavaScript interop, implementing parameters and EventCallback, RenderFragment slots, component lifecycle (OnInitializedAsync, OnParametersSet), async patterns, IAsyncDisposable, CancellationToken, CSS isolation, code-behind. DO NOT USE FOR: creating new projects (use create-blazor-project), JavaScript interop or calling browser APIs from Blazor (use use-js-interop), forms and validation (use collect-user-input), prerendering issues (use support-prerendering), HTTP data fetching patterns (use fetch-and-send-data), coordinating state between unrelated components (use coordinate-components).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1902,1903,1906,1908,1911],{"name":1839,"slug":1840,"type":15},{"name":1904,"slug":1905,"type":15},"Blazor","blazor",{"name":1907,"slug":229,"type":15},"C#",{"name":1909,"slug":1910,"type":15},"UI Components","ui-components",{"name":1912,"slug":1913,"type":15},"Web Development","web-development","2026-07-15T06:03:29.216359",{"slug":1916,"name":1916,"fn":1917,"description":1918,"org":1919,"tags":1920,"stars":25,"repoUrl":26,"updatedAt":1924},"binlog-failure-analysis","analyze MSBuild binary logs","Analyze MSBuild binary logs to diagnose build failures. USE FOR: build errors that are unclear from console output, diagnosing cascading failures across multi-project builds, tracing MSBuild target execution order, and generally any MSBuild build issues. Requires an existing .binlog file. DO NOT USE FOR: generating binlogs (use binlog-generation), non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1921,1922,1923],{"name":1842,"slug":1843,"type":15},{"name":1845,"slug":1846,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T08:21:34.637923",{"slug":1926,"name":1926,"fn":1927,"description":1928,"org":1929,"tags":1930,"stars":25,"repoUrl":26,"updatedAt":1938},"binlog-generation","generate MSBuild binary logs for diagnostics","Generate MSBuild binary logs (binlogs) for build diagnostics and analysis. USE FOR: adding \u002Fbl:{} to any dotnet build, test, pack, publish, or restore command to capture a full build execution trace, prerequisite for binlog-failure-analysis and build-perf-diagnostics skills, enabling post-build investigation of errors or performance. Requires MSBuild 17.8+ \u002F .NET 8 SDK+ for {} placeholder; PowerShell needs -bl:{{}}. DO NOT USE FOR: non-MSBuild build systems (npm, Maven, CMake), analyzing an existing binlog (use binlog-failure-analysis instead).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1931,1934,1935],{"name":1932,"slug":1933,"type":15},"Build","build",{"name":1845,"slug":1846,"type":15},{"name":1936,"slug":1937,"type":15},"Engineering","engineering","2026-07-19T05:38:19.340791",96,{"items":1941,"total":2046},[1942,1954,1961,1968,1976,1982,1990,1996,2002,2012,2025,2036],{"slug":1943,"name":1943,"fn":1944,"description":1945,"org":1946,"tags":1947,"stars":1951,"repoUrl":1952,"updatedAt":1953},"multithreaded-task-migration","migrate MSBuild tasks to multithreaded mode","Guide for migrating MSBuild tasks to multithreaded mode support, including compatibility red-team review. Use this when converting tasks to thread-safe versions, implementing IMultiThreadableTask, adding TaskEnvironment support, or auditing migrations for behavioral compatibility.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1948,1949,1950],{"name":1839,"slug":1840,"type":15},{"name":1936,"slug":1937,"type":15},{"name":1848,"slug":1849,"type":15},5535,"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fmsbuild","2026-07-22T05:37:33.965588",{"slug":1833,"name":1833,"fn":1834,"description":1835,"org":1955,"tags":1956,"stars":25,"repoUrl":26,"updatedAt":1850},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1957,1958,1959,1960],{"name":1839,"slug":1840,"type":15},{"name":1842,"slug":1843,"type":15},{"name":1845,"slug":1846,"type":15},{"name":1848,"slug":1849,"type":15},{"slug":1852,"name":1852,"fn":1853,"description":1854,"org":1962,"tags":1963,"stars":25,"repoUrl":26,"updatedAt":1863},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1964,1965,1966,1967],{"name":1839,"slug":1840,"type":15},{"name":1859,"slug":1860,"type":15},{"name":1845,"slug":1846,"type":15},{"name":17,"slug":18,"type":15},{"slug":1865,"name":1865,"fn":1866,"description":1867,"org":1969,"tags":1970,"stars":25,"repoUrl":26,"updatedAt":1881},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1971,1972,1973,1974,1975],{"name":1839,"slug":1840,"type":15},{"name":1845,"slug":1846,"type":15},{"name":1873,"slug":1874,"type":15},{"name":1876,"slug":1877,"type":15},{"name":1879,"slug":1880,"type":15},{"slug":1883,"name":1883,"fn":1884,"description":1885,"org":1977,"tags":1978,"stars":25,"repoUrl":26,"updatedAt":1895},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1979,1980,1981],{"name":1842,"slug":1843,"type":15},{"name":1890,"slug":1891,"type":15},{"name":1893,"slug":1894,"type":15},{"slug":1897,"name":1897,"fn":1898,"description":1899,"org":1983,"tags":1984,"stars":25,"repoUrl":26,"updatedAt":1914},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1985,1986,1987,1988,1989],{"name":1839,"slug":1840,"type":15},{"name":1904,"slug":1905,"type":15},{"name":1907,"slug":229,"type":15},{"name":1909,"slug":1910,"type":15},{"name":1912,"slug":1913,"type":15},{"slug":1916,"name":1916,"fn":1917,"description":1918,"org":1991,"tags":1992,"stars":25,"repoUrl":26,"updatedAt":1924},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1993,1994,1995],{"name":1842,"slug":1843,"type":15},{"name":1845,"slug":1846,"type":15},{"name":17,"slug":18,"type":15},{"slug":1926,"name":1926,"fn":1927,"description":1928,"org":1997,"tags":1998,"stars":25,"repoUrl":26,"updatedAt":1938},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1999,2000,2001],{"name":1932,"slug":1933,"type":15},{"name":1845,"slug":1846,"type":15},{"name":1936,"slug":1937,"type":15},{"slug":2003,"name":2003,"fn":2004,"description":2005,"org":2006,"tags":2007,"stars":25,"repoUrl":26,"updatedAt":2011},"build-parallelism","optimize MSBuild build parallelism","Diagnose and fix under-parallelized MSBuild builds. USE WHEN a multi-project solution build is slower than expected, doesn't speed up when you add cores, pegs a single core while others idle, or you want to know why `-m` isn't helping. Note: `\u002Fmaxcpucount` default is 1 (sequential) — always pass `-m` for parallel builds. Covers finding the critical path (longest serial ProjectReference chain), graph build (`\u002Fgraph`), BuildInParallel, and solution filters (`.slnf`). DO NOT USE FOR: single-project builds, incremental issues (use incremental-build), compilation slowness inside one project (use build-perf-diagnostics), non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2008,2009,2010],{"name":1839,"slug":1840,"type":15},{"name":1936,"slug":1937,"type":15},{"name":1848,"slug":1849,"type":15},"2026-07-19T05:38:18.364937",{"slug":2013,"name":2013,"fn":2014,"description":2015,"org":2016,"tags":2017,"stars":25,"repoUrl":26,"updatedAt":2024},"build-perf-baseline","establish and optimize build performance baselines","Establish build performance baselines and apply systematic optimization techniques. USE FOR: diagnosing slow builds, establishing before\u002Fafter measurements (cold, warm, no-op scenarios), applying optimization strategies like MSBuild Server, static graph builds, artifacts output, and dependency graph trimming. Start here before diving into build-perf-diagnostics, incremental-build, or build-parallelism. DO NOT USE FOR: non-MSBuild build systems, detailed bottleneck analysis (use build-perf-diagnostics after baselining).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2018,2019,2022,2023],{"name":1936,"slug":1937,"type":15},{"name":2020,"slug":2021,"type":15},"Monitoring","monitoring",{"name":1848,"slug":1849,"type":15},{"name":1893,"slug":1894,"type":15},"2026-07-12T08:21:35.865649",{"slug":2026,"name":2026,"fn":2027,"description":2028,"org":2029,"tags":2030,"stars":25,"repoUrl":26,"updatedAt":2035},"build-perf-diagnostics","diagnose MSBuild build performance bottlenecks","Diagnose MSBuild build performance bottlenecks using binary log analysis. USE FOR: identifying why builds are slow by analyzing binlog performance summaries, detecting ResolveAssemblyReference (RAR) taking >5s, Roslyn analyzers consuming >30% of Csc time, single targets dominating >50% of build time, node utilization below 80%, excessive Copy tasks, NuGet restore running every build. Covers timeline analysis, Target\u002FTask Performance Summary interpretation, and 7 common bottleneck categories. Use after build-perf-baseline has established measurements. DO NOT USE FOR: establishing initial baselines (use build-perf-baseline first), fixing incremental build issues (use incremental-build), parallelism tuning (use build-parallelism), non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2031,2032,2033,2034],{"name":1839,"slug":1840,"type":15},{"name":1845,"slug":1846,"type":15},{"name":1936,"slug":1937,"type":15},{"name":1848,"slug":1849,"type":15},"2026-07-12T08:21:40.961722",{"slug":2037,"name":2037,"fn":2038,"description":2039,"org":2040,"tags":2041,"stars":25,"repoUrl":26,"updatedAt":2045},"check-bin-obj-clash","detect MSBuild output path conflicts","Detects MSBuild projects with conflicting OutputPath or IntermediateOutputPath. USE FOR: builds failing with 'Cannot create a file when that file already exists', 'The process cannot access the file because it is being used by another process', intermittent build failures that succeed on retry, or missing\u002Foverwritten outputs in multi-project or multi-targeting builds where bin\u002Fobj (or project.assets.json) collide. Common causes: shared OutputPath, missing AppendTargetFrameworkToOutputPath, extra global properties (e.g. PublishReadyToRun), or SetTargetFramework on a ProjectReference to a single-targeting project. DO NOT USE FOR: file access errors unrelated to MSBuild (OS-level locking), single-project single-TFM builds, non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2042,2043,2044],{"name":1845,"slug":1846,"type":15},{"name":1936,"slug":1937,"type":15},{"name":1890,"slug":1891,"type":15},"2026-07-19T05:38:14.336279",144]