What problem does it solve? Building file upload endpoints in ASP.NET Core minimal APIs involves several non-obvious pitfalls: IFormFile binding rules, two separate size limits (Kestrel and FormOptions), automatic anti-forgery validation in .NET 8+, and security risks from trusting user-provided filenames or content types. This Skill provides correct, production-oriented patterns that avoid these common mistakes. ## Core Features & Use Cases - IFormFile Binding Patterns: Correctly bind single files, multiple files (IFormFileCollection), and mixed form fields using [FromForm] in minimal APIs. - Size Limit Configuration: Configure both Kestrel MaxRequestBodySize and FormOptions.MultipartBodyLengthLimit, plus per-endpoint overrides with RequestSizeLimit. - Security Validation: Validate uploads via magic bytes instead of trusting Content-Type or file extensions, and generate safe filenames to prevent path traversal attacks. - Large File Streaming: Use MultipartReader to stream very large files directly to disk without buffering. - Use Case: You are building a .NET 8+ API that accepts image uploads and keeps getting 400 errors or oversized request failures; this Skill walks you through anti-forgery opt-out, dual size limits, and content validation step by step. ## Quick Start Ask the AI to implement a secure file upload endpoint in an ASP.NET Core minimal API with size limits and content type validation.
