How do you handle a large file upload in an ASP.NET Core API?
Quick Answer
For small files, IFormFile is fine — it buffers to memory/disk. For large files, stream the multipart request with MultipartReader so you never hold the whole file in memory, write it straight to blob storage, and set request size limits (RequestSizeLimit, Kestrel/IIS max body size) deliberately. Validate the content type and size, and virus-scan before making it available.
For a normal-sized file, IFormFile is fine. For a large file it's the wrong tool because it buffers the whole thing before my code runs. Instead I stream it — disable the automatic form binding, use a MultipartReader, and copy each section straight to blob storage without ever holding it in memory. I set the request size limits explicitly at the Kestrel and framework level. For really large or resumable uploads, the best approach is a pre-signed URL so the client uploads directly to cloud storage and it never hits my app server. And I validate the actual file content, not just the extension, and scan it before it's usable.
IFormFiletriggers full model binding, which buffers the request — bad for a 2 GB upload.- Streaming: disable form-value binding, use
Request.BodyReader/MultipartReader, copy each section to a destination stream. - Limits:
[RequestSizeLimit(bytes)],[DisableRequestSizeLimit],KestrelServerLimits.MaxRequestBodySize,FormOptions.MultipartBodyLengthLimit. - Better for very large / resumable uploads: a pre-signed URL directly to cloud storage, so the file never touches your app server.
- Security: check the real content (magic bytes), cap the size, scan for malware, store outside the web root.