Instant uploads: skip the transfer when the server already has the bytes

The mechanism

Before transferring, the client computes the file's SHA-256 (in a Web Worker, off the main thread) and asks the server one question:

GET /api/upload/exists?hash=0afcd030...&size=51200

{ "exists": true, "fileGuid": "9f505814-...", "fileName": "deck.pdf", "fileSize": 51200 }

On a hit, the task completes through the normal success path - events, queue, completed list - with the existing file's id and result.deduped: true. Nothing is transferred. On a miss (or a 404, meaning the feature is off), the upload proceeds exactly as before.

Why the server must do its own hashing

The dedupe index is only as trustworthy as the hashes in it. If the server indexed client-claimed hashes, an attacker could upload malware.bin while claiming the hash of a popular installer - and every later uploader of the real installer would be "deduped" onto the malware. CoreUpload therefore hashes every stored upload itself, streaming, while the bytes are written. Client-claimed checksums are used for integrity verification, never for dedupe.

Setup

// Server (Program.cs) - off by default
builder.Services.AddCoreUpload(options =>
{
    options.EnableInstantUpload = true;
});

// Client
CoreUpload.create('#uploader', {
    uploadUrl: '/api/upload/upload',
    instantUpload: true,
    onInstantUpload: function (task, result) {
        console.log(task.fileName + ' deduped -> ' + result.fileGuid);
    }
});

The trade-off you are opting into

The probe answers "does this exact content exist on this server?" - which is itself information. In a multi-tenant system, that can confirm whether some known document has been uploaded by anyone. That is why the feature is off by default. Enable it where the answer is harmless (single-tenant apps, internal tools, public assets), or put your own authorization in front of the endpoint group so the probe is scoped per user or tenant. Two more boundaries to know: renditions and client-side encrypted uploads never probe (their bytes legitimately differ from the source hash), and dedupe hits only ever reference files still present in the store.

See it live

The Instant Upload demo uploads a file normally the first time, then completes the identical file instantly on the second attempt - watch the network panel: the only request is the probe.