FastAPI file upload handling with validation

<p>I need an endpoint that accepts file uploads (CSV, JSON, images). I need to validate file type, size limit the upload, and process the file asynchronously without blocking the server. I want to handle both small in-memory files and large streaming uploads.</p>

<p>Use FastAPI's <code>UploadFile</code> for file handling:</p> <div class="highlight"><pre><span></span><code><span class="kn">from</span><span class="w"> </span><span class="nn">fastapi</span><span class="w"> </span><span class="kn">import</span> <span class="n">FastAPI</span><span class="p">,</span> <span class="n">UploadFile</span><span class="p">,</span> <span class="n">File</span><span class="p">,</span> <span class="n">HTTPException</span> <span class="kn">from</span><span class="w"> </span><span class="nn">pathlib</span><span class="w"> </span><span class="kn">import</span> <span class="n">Path</span> <span class="kn">import</span><span class="w"> </span><span class="nn">aiofiles</span> <span class="kn">import</span><span class="w"> </span><span class="nn">magic</span> <span class="c1"># pip install python-magic</span> <span class="n">MAX_SIZE</span> <span class="o">=</span> <span class="mi">10</span> <span class="o">*</span> <span class="mi">1024</span> <span class="o">*</span> <span class="mi">1024</span> <span class="c1"># 10 MB</span> <span class="n">ALLOWED_TYPES</span> <span class="o">=</span> <span class="p">{</span><span class="s1">'application/json'</span><span class="p">,</span> <span class="s1">'text/csv'</span><span class="p">,</span> <span class="s1">'text/plain'</span><span class="p">}</span> <span class="nd">@router</span><span class="o">.</span><span class="n">post</span><span class="p">(</span><span class="s1">'/upload'</span><span class="p">)</span> <span class="k">async</span> <span class="k">def</span><span class="w"> </span><span class="nf">upload_file</span><span class="p">(</span><span class="n">file</span><span class="p">:</span> <span class="n">UploadFile</span> <span class="o">=</span> <span class="n">File</span><span class="p">(</span><span class="o">...</span><span class="p">)):</span> <span class="c1"># Check content type from header (can be spoofed)</span> <span class="k">if</span> <span class="n">file</span><span class="o">.</span><span class="n">content_type</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">ALLOWED_TYPES</span><span class="p">:</span> <span class="k">raise</span> <span class="n">HTTPException</span><span class="p">(</span><span class="mi">415</span><span class="p">,</span> <span class="sa">f</span><span class="s1">'Unsupported type: </span><span class="si">{</span><span class="n">file</span><span class="o">.</span><span class="n">content_type</span><span class="si">}</span><span class="s1">'</span><span class="p">)</span> <span class="c1"># Read with size limit</span> <span class="n">content</span> <span class="o">=</span> <span class="sa">b</span><span class="s1">''</span> <span class="k">while</span> <span class="n">chunk</span> <span class="o">:=</span> <span class="k">await</span> <span class="n">file</span><span class="o">.</span><span class="n">read</span><span class="p">(</span><span class="mi">8192</span><span class="p">):</span> <span class="n">content</span> <span class="o">+=</span> <span class="n">chunk</span> <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">content</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">MAX_SIZE</span><span class="p">:</span> <span class="k">raise</span> <span class="n">HTTPException</span><span class="p">(</span><span class="mi">413</span><span class="p">,</span> <span class="s1">'File too large (max 10 MB)'</span><span class="p">)</span> <span class="c1"># Verify actual MIME type (not just header)</span> <span class="n">actual_type</span> <span class="o">=</span> <span class="n">magic</span><span class="o">.</span><span class="n">from_buffer</span><span class="p">(</span><span class="n">content</span><span class="p">[:</span><span class="mi">1024</span><span class="p">],</span> <span class="n">mime</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span> <span class="k">if</span> <span class="n">actual_type</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">ALLOWED_TYPES</span><span class="p">:</span> <span class="k">raise</span> <span class="n">HTTPException</span><span class="p">(</span><span class="mi">415</span><span class="p">,</span> <span class="sa">f</span><span class="s1">'Actual content type </span><span class="si">{</span><span class="n">actual_type</span><span class="si">}</span><span class="s1"> not allowed'</span><span class="p">)</span> <span class="c1"># Process content (e.g., parse JSON):</span> <span class="k">if</span> <span class="n">file</span><span class="o">.</span><span class="n">content_type</span> <span class="o">==</span> <span class="s1">'application/json'</span><span class="p">:</span> <span class="kn">import</span><span class="w"> </span><span class="nn">json</span> <span class="n">data</span> <span class="o">=</span> <span class="n">json</span><span class="o">.</span><span class="n">loads</span><span class="p">(</span><span class="n">content</span><span class="p">)</span> <span class="k">return</span> <span class="k">await</span> <span class="n">process_json_upload</span><span class="p">(</span><span class="n">data</span><span class="p">)</span> <span class="k">return</span> <span class="p">{</span><span class="s1">'filename'</span><span class="p">:</span> <span class="n">file</span><span class="o">.</span><span class="n">filename</span><span class="p">,</span> <span class="s1">'size'</span><span class="p">:</span> <span class="nb">len</span><span class="p">(</span><span class="n">content</span><span class="p">)}</span> <span class="c1"># For large files — stream to disk:</span> <span class="nd">@router</span><span class="o">.</span><span class="n">post</span><span class="p">(</span><span class="s1">'/upload/large'</span><span class="p">)</span> <span class="k">async</span> <span class="k">def</span><span class="w"> </span><span class="nf">upload_large</span><span class="p">(</span><span class="n">file</span><span class="p">:</span> <span class="n">UploadFile</span><span class="p">):</span> <span class="n">path</span> <span class="o">=</span> <span class="n">Path</span><span class="p">(</span><span class="s1">'/tmp'</span><span class="p">)</span> <span class="o">/</span> <span class="n">file</span><span class="o">.</span><span class="n">filename</span> <span class="k">async</span> <span class="k">with</span> <span class="n">aiofiles</span><span class="o">.</span><span class="n">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s1">'wb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span> <span class="k">while</span> <span class="n">chunk</span> <span class="o">:=</span> <span class="k">await</span> <span class="n">file</span><span class="o">.</span><span class="n">read</span><span class="p">(</span><span class="mi">65536</span><span class="p">):</span> <span class="k">await</span> <span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">chunk</span><span class="p">)</span> <span class="k">return</span> <span class="p">{</span><span class="s1">'path'</span><span class="p">:</span> <span class="nb">str</span><span class="p">(</span><span class="n">path</span><span class="p">)}</span> </code></pre></div> <p>Key points: - Always verify actual MIME type with <code>python-magic</code> — <code>content_type</code> header is user-controlled - Stream-read with chunks to avoid loading huge files into memory - <code>aiofiles</code> for non-blocking file I/O (don't use <code>open()</code> in async routes) - Set Nginx/proxy upload size limit (<code>client_max_body_size</code>) before FastAPI sees the request</p>