Server Pipeline

The server side of CoreUpload is split into three layers:

• AddCoreUpload() registers the default provider, upload service, progress service, license service, and cleanup background service
• UseCoreUpload() relaxes request-size limits for the configured upload route prefix
• MapCoreUploadEndpoints() exposes the upload, chunk, progress, info, download, delete, and validate endpoints

Default route set

By default, the endpoints are published under /api/upload:

• POST /api/upload/upload
• POST /api/upload/upload/multiple
• POST /api/upload/chunk
• POST /api/upload/chunk/complete
• GET /api/upload/progress/{uploadId}
• GET /api/upload/{fileGuid}/info
• GET /api/upload/{fileGuid}/download
• DELETE /api/upload/{fileGuid}
• POST /api/upload/validate

Extensibility points

• Replace IUploaderProvider to store files somewhere other than the local file system
• Implement IUploadEventHandler to react to validation and upload completion
• Callers can also use IUploadService directly when building custom endpoints

Securing stored files (5.2.3)

By default the endpoints are capability-based: GET /{guid}/info, GET /{guid}/download and DELETE /{guid} require only the file's GUID. Those GUIDs are unguessable v4 values, so this behaves like an unlisted share link — good for zero-config use, but a GUID that leaks through a referrer header, a log, or a screenshot grants access.

To scope files to a user or tenant, register an authorization handler:

builder.Services.AddSingleton<IUploadAuthorizationHandler, MyUploadAuthorization>();

public sealed class MyUploadAuthorization : IUploadAuthorizationHandler
{
    public ValueTask<bool> AuthorizeAsync(HttpContext http, Guid fileGuid,
                                          UploadFileAction action, CancellationToken ct = default)
    {
        var owner = MyDb.GetOwnerOf(fileGuid);          // your storage
        return ValueTask.FromResult(owner == http.User.Identity?.Name);
    }
}

Denials answer 404 rather than 403, so a caller cannot probe which GUIDs exist. DELETE also honors CoreUploadOptions.EnableAntiforgery (off by default).

Error detail

Endpoint failures return a generic message plus a correlation id; the exception (which can carry signer endpoints, bucket names and server paths) is logged server-side under that id. Set CoreUploadOptions.VerboseErrors = true in development to get the raw message back.