File Extension Validation

Restrict uploads to specific file types using the asp-extensions attribute. Files that do not match the allowed extensions are rejected immediately on the client side before any upload begins.

Images Only (.jpg, .png, .gif, .webp)

Documents Only (.pdf, .doc, .docx, .xls, .xlsx)

<!-- Images only -->
<core-upload asp-upload-url="/api/upload/upload"
 asp-extensions=".jpg,.png,.gif,.webp"
 asp-max-size="5MB"
 asp-button-text="Select Images">
</core-upload> 
<!-- Documents only -->
<core-upload asp-upload-url="/api/upload/upload"
 asp-extensions=".pdf,.doc,.docx,.xls,.xlsx"
 asp-max-size="20MB"
 asp-button-text="Select Documents">
</core-upload>

The list the component enforces

asp-extensions rejects files that do not match before any transfer starts, and also supplies the file dialog's filter, so the picker and the rule agree without you writing the list twice.

Allow-list, never deny-list

Enumerating what you accept is finite and reviewable. Enumerating what you reject is a race you lose — there is always another extension, another double extension, another platform's executable format. If the answer is “images and PDFs”, say exactly that.