I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I expect an image file.

Basically I wanted to prevent DoS attacks of the type resource consumption. i.e., an attacker can eat the memory of the server by uploading large files into the server. How to prevent such attacks by server side validations?


One easy thing you may do is limiting maximum POST size, as well as upload max file size.

For exemple, using PHP, you may tweak :

post_max_size integer
    Sets max size of post data allowed. This setting also affects file upload.
    To upload large files, this value must be larger than upload_max_filesize.
    If memory limit is enabled by your configure script, memory_limit also
    affects file uploading. Generally speaking, memory_limit should be larger
    than post_max_size. When an integer is used, the value is measured in bytes.
    Shorthand notation, as described in this FAQ, may also be used. If the size
    of post data is greater than post_max_size, the $_POST and $_FILES
    superglobals are empty [...]

max_file_uploads integer
    The maximum number of files allowed to be uploaded simultaneously. Starting
    with PHP 5.3.4, upload fields left blank on submission do not count towards
    this limit.
  • I think this might work. I will be thankful if you could point me to some place where the same can be done with Java. – Anonymous Platypus Mar 11 '15 at 11:00
  • 1
    Maybe here ? – Benjamin MALYNOVYTCH Mar 11 '15 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.