minimal-api-file-upload

To handle file uploads in ASP.NET Core minimal APIs, bind IFormFile or IFormFileCollection parameters and use [FromForm] for mixed multipart fields. This ensures correct multipart/form-data parsing and reliable request processing without manual extraction.

The best way to stream large file uploads is using MultipartReader to process multipart data without buffering the entire request in memory. This approach prevents memory exhaustion and enables reliable disk streaming for large files.

Configure request size limits by adjusting both Kestrel request limits and FormOptions multipart/form limits. You can apply global limits and use per-endpoint overrides to safely handle different upload size requirements.

Prevent path traversal attacks by generating safe filenames instead of trusting user input. Additionally, validate file content via magic bytes rather than extensions alone to mitigate file-based attacks.

Yes, .NET 8+ enables anti-forgery defaults for minimal APIs to prevent CSRF problems. You need optional anti-forgery handling configured to secure multipart/form-data file upload endpoints against cross-site request forgery.