file-handling

Validate file uploads by checking file size against configured limits, verifying the extension against an allowlist, and reading magic number signatures to confirm content matches the declared type. Never trust the file extension alone since malicious files can use safe-looking extensions.

Use MultipartReader to stream request sections directly to storage instead of buffering with IFormFile. Set RequestSizeLimit and RequestFormLimits attributes to allow large bodies, then copy section streams to your storage backend without loading the full file into memory.

Local file storage works for single-server deployments and development, while Azure Blob Storage suits distributed or scaled-out applications. Abstract both behind an IFileStorageService interface so you can swap implementations through configuration without changing page code.

Prevent path traversal by calling Path.GetFileName on user-supplied filenames to strip directory components, then generate a new GUID-based filename for storage. Never combine raw user filenames with server paths, and return opaque file IDs instead of internal paths.

ASP.NET Core enforces default request body and multipart limits around 28-30MB. Raise them with the RequestSizeLimit and RequestFormLimits attributes on your page handler, and configure Kestrel or IIS max request body size if hosting limits still block the upload.