multipart/form-data
multipartThe MIME type for file upload form submissions. Required when an HTML form contains file input fields (enctype='multipart/form-data'). The body is divided into parts by a boundary string, each part having its own Content-Disposition and optional Content-Type. The boundary is auto-generated by browsers and included in the Content-Type header.
Details
multipart/form-data is defined by RFC 7578. It is the required encoding for HTML forms with file uploads.
Structure: Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryXyz Each part: --boundary Content-Disposition: form-data; name="fieldname" [blank line] [field value] --boundary Content-Disposition: form-data; name="file"; filename="photo.jpg" Content-Type: image/jpeg [blank line] [binary file data] --boundary-- (terminating boundary has trailing --)
Fetch API: when using FormData with fetch, do NOT manually set Content-Type – let the browser set it so the boundary is included: fetch('/upload', { method: 'POST', body: formData }) // correct // do NOT: headers: { 'Content-Type': 'multipart/form-data' } // wrong – missing boundary
Parameters
| Parameter | Description |
|---|---|
| boundary | Required. Unique string separating body parts. Browser generates automatically for HTML forms. |
Common use
File upload forms, API endpoints accepting file uploads
Security note
Always validate file types server-side (check magic bytes, not just extension or client-declared MIME type). Set maximum file size limits. Scan uploads for malware.