Build a File Upload API in Golang

Just look around you, we are all surrounded by apps that upload files in one form or another - Facebook, Gmail, Github and even the videos I have uploaded on YouTube is an implementation of some file upload API. In fact, I can confidently say that File Upload is Second most implemented feature after the login Page. Still, its hardly the case that many of us can implement this, the right way. So lets fix that. File Uploaded with Local Storage Lets start with a basic implementation. Trust me its so simple, like a kindergarten syllabus. Here we create an API Handler which takes in a file (multipart/form-data) from request, processes the file and save it in the server codebase. The above example works, but the problem is, it just works. Let’s take it to the NEXT LEVEL and make this API a bit more resilient to client request. Well If you code this example, You my friend will soon be HACKED!!! And this is something not many teach you not even ChatGPT. This code is more insecure than hard-coded secrets in GitHub repository. Think about it - What if I send text data instead of a file? What if the file I am sending, is more than 50 GB? What if I upload a PDF file when the server is expecting an image file? Let’s go by an example, suppose you are building user profile picture API. Almost every app has this API be it Github, YouTube, Facebook, Instagram, you name it. Here in this series, we will build a similar API. How to Improve this API? Check the header Content-Type has multipart/form-data Set maximum and minimum limits for file size to be uploaded Properly sanitise the filename before saving Avoid file name clashes, with unique file names First we improve the mime type detector, well what’s wrong with MIME detector. Even though, it works fine we can add some simple optimisation using Maps for O(1) lookups Next We will tackle checking the header section. We are checking the request header (Content-Type) then the file header for relevant information. Since our profile picture API only needs to upload images, we check for accepted file-types only Finally, we improve the file name, by adding a UUID for uniqueness and replace space with underscores. In the next post we will further improve this API and move towards more scalable, production ready API with S3 Integration. Full Code on Github for your reference Subscribe Bits Of Mandal in YouTube for Awesome GoLang videos

May 4, 2025 - 20:33

Just look around you, we are all surrounded by apps that upload files in one form or another - Facebook, Gmail, Github and even the videos I have uploaded on YouTube is an implementation of some file upload API.

In fact, I can confidently say that File Upload is Second most implemented feature after the login Page. Still, its hardly the case that many of us can implement this, the right way. So lets fix that.

File Uploaded with Local Storage

Lets start with a basic implementation. Trust me its so simple, like a kindergarten syllabus.

Here we create an API Handler which takes in a file (multipart/form-data) from request, processes the file and save it in the server codebase.

The above example works, but the problem is, it just works.

Let’s take it to the NEXT LEVEL and make this API a bit more resilient to client request. Well If you code this example, You my friend will soon be HACKED!!! And this is something not many teach you not even ChatGPT.

This code is more insecure than hard-coded secrets in GitHub repository.

Think about it -

What if I send text data instead of a file?
What if the file I am sending, is more than 50 GB?
What if I upload a PDF file when the server is expecting an image file?

Let’s go by an example, suppose you are building user profile picture API. Almost every app has this API be it Github, YouTube, Facebook, Instagram, you name it. Here in this series, we will build a similar API.

How to Improve this API?

Check the header Content-Type has multipart/form-data
Set maximum and minimum limits for file size to be uploaded
Properly sanitise the filename before saving
Avoid file name clashes, with unique file names

First we improve the mime type detector, well what’s wrong with MIME detector. Even though, it works fine we can add some simple optimisation using Maps for O(1) lookups

Next We will tackle checking the header section. We are checking the request header (Content-Type) then the file header for relevant information.

Since our profile picture API only needs to upload images, we check for accepted file-types only

Finally, we improve the file name, by adding a UUID for uniqueness and replace space with underscores.

In the next post we will further improve this API and move towards more scalable, production ready API with S3 Integration.

Full Code on Github for your reference
Subscribe Bits Of Mandal in YouTube for Awesome GoLang videos