Learn
Plain-English guides to the parts of file uploading that are harder than they look. Written from the problems we actually hit building CoreUpload — useful whether or not you use it.
Why big uploads fail, how splitting a file into parts fixes it, picking a chunk size, and the four mistakes that corrupt the assembled file.
How webkitdirectory and drag-and-drop traversal really work, where the folder tree gets lost, and how to preserve and safely recreate it server-side.
Hash the file, ask the server, skip the transfer — the design behind zero-byte re-uploads, and why the server must never trust a client-claimed hash.
tus, S3 multipart and GCS sessions; surviving a page reload; and why trusting your own resume state silently corrupts files.
Sending bytes from the browser straight to S3, Azure Blob or GCS — pre-signed URLs, why your web server should not be a proxy, and the CORS gotchas.
Fix 413 / maxAllowedContentLength / MaxRequestBodySize — every limit in the chain, and when to chunk instead of raising them.
What actually goes wrong — executable uploads, spoofed content types, path traversal, XSS via file names, pixel bombs — and the control for each.
Extension allowlists, why Content-Type lies, magic-byte checks, dimension rules and hashing — and where each check belongs.
413, 404 on the endpoint, CORS, antiforgery 400s, hangs at 100%, and "works locally, fails in production" — symptom to cause.
Accessible names for icon buttons, a keyboard path around drag-and-drop, announcing progress without flooding the user, and keeping focus alive across queue re-renders.
Faking IFormFile, driving the real endpoint with WebApplicationFactory, and the chunked-upload test that passes while proving nothing.
Chunk size, concurrency and where extra parallelism stops helping; the server-side costs that usually dominate.
Every concept here has a live demo with copyable code — over 100 of them.
