Skip to content

DevelopmentUpdated 2 min read

Website file uploads: usable controls and server-side checks

A visitor selects a document and submits it, then discovers that it exceeds a size limit never mentioned beforehand. Elsewhere an upload succeeds but the private document is stored at a publicly accessible address. One failure concerns usability; the other concerns access control.

An upload has two sides: the person needs to understand the submission, and the system must treat incoming content as untrusted. A convenient control cannot replace server checks.

Explain limits before selection

State formats, maximum size and file count. Match them to the task rather than accepting every possible type. If a photograph is needed, say so before someone selects a document.

Show the chosen filename and a replacement route. Progress should describe a stage that can actually be measured. Completing transfer may precede validation; explain those states distinctly.

An employee selects a document for a website form on a laptop
Explain whether a file is transferring, being checked or has been accepted.

Validate on the server

The OWASP upload guidance describes layered protection. An extension or browser-supplied content type alone cannot establish trust. Check allowed content, size and permission on the server.

Control stored filenames to prevent overwriting. Uploaded material must not become executable code accidentally. Keep processing libraries maintained and resource limits appropriate. The implementation needs safeguards suited to its risks.

An upload needs both clarity and controlled handling
A file-submission checklist. An illustrative planning example.

Verify access after storage

Decide who can view the document and how long it is retained before collecting it. A public folder should not be the automatic choice for a private application. Deliver files to authorised recipients through a controlled route.

  • Try an allowed file, incorrect type and excessive size.
  • Test interruption and a repeated attempt.
  • Check retrieval through permitted and different accounts.
  • Confirm uploads cannot replace another file.
  • Test deletion and retention with a sample record.

When building a web form, success includes correct receipt, clear feedback and controlled use. A file appearing on the server cannot establish that the complete task is finished.

More articles