File Uploads and Form Data

using Microsoft.AspNetCore.Mvc;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddCookie();
builder.Services.AddAuthorization();
builder.Services.AddAntiforgery();
var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
app.UseAntiforgery(); // after authentication and authorization

// Browser form with cookie auth: the antiforgery token field must be posted with the files.
app.MapPost("/returns/{orderId:int}/photos", async (int orderId, [FromForm] ReturnRequest request, IFormFileCollection photos, CancellationToken ct) =>
{
    if (photos.Count is 0 or > 5)
        return Results.Problem(statusCode: 400, title: "Attach between 1 and 5 photos.");

    var saved = new List<string>();
    foreach (var photo in photos)
    {
        if (photo.Length > 5 * 1024 * 1024 || photo.ContentType is not ("image/jpeg" or "image/png"))
            return Results.Problem(statusCode: 400, title: "Photos must be JPEG or PNG and at most 5 MB.");
        saved.Add($"{Guid.NewGuid():N}{(photo.ContentType == "image/png" ? ".png" : ".jpg")}");
    }
    return Results.Ok(new { orderId, request.Reason, photos = saved });
}).RequireAuthorization();

app.Run();

public sealed class ReturnRequest
{
    public string Reason { get; set; } = "";
    public bool Damaged { get; set; }
}

using Microsoft.AspNetCore.WebUtilities;
using Microsoft.Net.Http.Headers;

const long MaxImportBytes = 2L * 1024 * 1024 * 1024; // 2 GB

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddJwtBearer();
builder.Services.AddAuthorization();
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

app.MapPost("/imports/orders", async (HttpRequest request, CancellationToken ct) =>
{
    if (!MediaTypeHeaderValue.TryParse(request.ContentType, out var mediaType) || mediaType.Boundary.Length == 0)
        return Results.Problem(statusCode: 415, title: "Expected multipart/form-data.");

    // Per-endpoint body limit; Kestrel's global 30 MB default stays in place elsewhere.
    request.HttpContext.Features.Get<Microsoft.AspNetCore.Http.Features.IHttpMaxRequestBodySizeFeature>()!.MaxRequestBodySize = MaxImportBytes;

    var reader = new MultipartReader(HeaderUtilities.RemoveQuotes(mediaType.Boundary).Value!, request.Body);
    var importId = Guid.NewGuid().ToString("N");
    // Local disk keeps the example self-contained; production streams to blob or S3 storage instead.
    var target = Path.Combine(Path.GetTempPath(), $"orders-import-{importId}.csv");
    long total = 0;
    var files = 0;
    var completed = false;

    try
    {
        while (await reader.ReadNextSectionAsync(ct) is { } section)
        {
            if (!ContentDispositionHeaderValue.TryParse(section.ContentDisposition, out var disposition) || !disposition.IsFileDisposition())
                continue;
            if (++files > 1)
                return Results.Problem(statusCode: 400, title: "Send exactly one import file.");

            await using var output = File.Create(target);
            var buffer = new byte[81920];
            int read;
            while ((read = await section.Body.ReadAsync(buffer, ct)) > 0)
            {
                total += read;
                if (total > MaxImportBytes) return Results.Problem(statusCode: 413, title: "Import too large.");
                await output.WriteAsync(buffer.AsMemory(0, read), ct);
            }
        }

        if (files == 0) return Results.Problem(statusCode: 400, title: "Send exactly one import file.");
        completed = true;
        return Results.Accepted($"/imports/orders/{importId}", new { bytes = total });
    }
    finally
    {
        // A limit breach, a disconnect or an exception must not leave up to 2 GB behind in temp.
        if (!completed) File.Delete(target);
    }
}).RequireAuthorization();

app.Run();

{
  // Kestrel:Limits is ignored unless Program.cs binds it:
  // builder.Services.Configure<KestrelServerOptions>(builder.Configuration.GetSection("Kestrel"));
  "Kestrel": {
    "Limits": {
      // Global ceiling for every request body (default 30000000 bytes).
      // Keep it modest; raise it per endpoint with RequestSizeLimitAttribute.
      "MaxRequestBodySize": 31457280
    }
  },
  "Uploads": {
    "MaxInvoicePdfBytes": 10485760,
    "AllowedInvoiceTypes": [ "application/pdf" ]
  }
}