What problem does it solve? Building file upload endpoints in ASP.NET Core minimal APIs involves several non-obvious pitfalls: IFormFile binding rules, two separate size limits (Kestrel and FormOptions), automatic anti-forgery validation in .NET 8+, and security risks from trusting user-provided filenames or content types. This Skill provides correct, production-oriented patterns to avoid these common mistakes. ## Core Features & Use Cases - IFormFile Binding: Correctly bind single files, multiple files (IFormFileCollection), and mixed form fields using [FromForm] in minimal API endpoints. - Size Limit Configuration: Configure both Kestrel MaxRequestBodySize and FormOptions.MultipartBodyLengthLimit, plus per-endpoint overrides with RequestSizeLimit or DisableRequestSizeLimit. - Security Validation: Validate uploads via magic bytes instead of trusting Content-Type or file extensions, and generate safe filenames to prevent path traversal attacks. - Large File Streaming: Use MultipartReader to stream very large files directly to storage without buffering. - Use Case: You are building a .NET 8 API that accepts profile image uploads. Use this Skill to create an endpoint that enforces a 10 MB limit, verifies JPEG/PNG magic bytes, disables anti-forgery for JWT-authenticated clients, and saves files with GUID-based names. ## Quick Start Ask the AI to create a minimal API file upload endpoint in .NET 8 that accepts images, enforces size limits, validates file content, and protects against path traversal.
