File Upload APIs

1<!-- Web.config: allow uploads up to 10 MB -->
2<system.web>
3  <httpRuntime targetFramework="4.8" maxRequestLength="10240" />      <!-- KB -->
4</system.web>
5<system.webServer>
6  <security>
7    <requestFiltering>
8      <requestLimits maxAllowedContentLength="10485760" />          <!-- bytes -->
9    </requestFiltering>
10  </security>
11</system.webServer>

1using System;
2using System.Collections.Generic;
3using System.IO;
4using System.Linq;
5using System.Net;
6using System.Net.Http;
7using System.Net.Http.Headers;
8using System.Threading.Tasks;
9using System.Web;
10using System.Web.Hosting;
11using System.Web.Http;
12

13[RoutePrefix("api/files")]
14public class FilesController : ApiController
15{
16    private static readonly string[] AllowedExtensions = { ".jpg", ".jpeg", ".png", ".pdf" };
17    private const long MaxBytes = 5 * 1024 * 1024;   // 5 MB
18

19    private static string UploadRoot => HostingEnvironment.MapPath("~/App_Data/uploads");
20

21    [HttpPost, Route("")]
22    public async Task<IHttpActionResult> Upload()
23    {
24        if (!Request.Content.IsMimeMultipartContent())
25            return StatusCode(HttpStatusCode.UnsupportedMediaType);
26

27        Directory.CreateDirectory(UploadRoot);
28        var provider = new MultipartFormDataStreamProvider(UploadRoot);
29        await Request.Content.ReadAsMultipartAsync(provider);
30

31        var saved = new List<object>();
32        foreach (var file in provider.FileData)
33        {
34            string original = Path.GetFileName(file.Headers.ContentDisposition.FileName.Trim('"'));
35            string extension = Path.GetExtension(original).ToLowerInvariant();
36            long size = new FileInfo(file.LocalFileName).Length;
37

38            if (!AllowedExtensions.Contains(extension) || size > MaxBytes)
39            {
40                File.Delete(file.LocalFileName);
41                return BadRequest(original + " is not allowed (jpg, png or pdf up to 5 MB).");
42            }
43

44            string storedName = Guid.NewGuid().ToString("N") + extension;
45            File.Move(file.LocalFileName, Path.Combine(UploadRoot, storedName));
46            saved.Add(new { original, storedName, size });
47        }
48

49        string description = provider.FormData["description"];
50        return Ok(new { description, files = saved });
51    }
52

53    [HttpGet, Route("{name}")]
54    public HttpResponseMessage Download(string name)
55    {
56        string safeName = Path.GetFileName(name);                 // blocks ../../web.config
57        string path = Path.Combine(UploadRoot, safeName);
58        if (!File.Exists(path)) return Request.CreateResponse(HttpStatusCode.NotFound);
59

60        var response = new HttpResponseMessage(HttpStatusCode.OK)
61        {
62            Content = new StreamContent(File.OpenRead(path)),
63        };
64        response.Content.Headers.ContentType = new MediaTypeHeaderValue(MimeMapping.GetMimeMapping(safeName));
65        response.Content.Headers.ContentDisposition = new ContentDispositionHeaderValue("attachment") { FileName = safeName };
66        return response;
67    }
68}

POST /api/files   Content-Type: multipart/form-data
  description=Invoice October
  file=@invoice.pdf (240 KB)
→ 200 {"description":"Invoice October","files":[{"original":"invoice.pdf","storedName":"9b1e...c4.pdf","size":245760}]}

POST /api/files   file=@setup.exe   → 400 "setup.exe is not allowed (jpg, png or pdf up to 5 MB)."
GET  /api/files/9b1e...c4.pdf        → 200  Content-Type: application/pdf
                                        Content-Disposition: attachment; filename=9b1e...c4.pdf