File validation (size, type) in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when uploading a file larger than 1MB?

Consider this FastAPI endpoint that accepts a file upload and checks its size to be under 1MB. What will be the response if a user uploads a file of 2MB?

FastAPI

from fastapi import FastAPI, File, UploadFile, HTTPException

app = FastAPI()

@app.post('/upload')
async def upload_file(file: UploadFile = File(...)):
    contents = await file.read()
    if len(contents) > 1024 * 1024:
        raise HTTPException(status_code=400, detail='File too large')
    return {'filename': file.filename, 'size': len(contents)}

A The server returns a 400 error with detail 'File too large'.

B The server crashes with a runtime error due to memory overflow.

C The server accepts the file and returns its filename and size.

D The server ignores the file and returns an empty response.

💡 Hint

Look at the condition that checks the file size after reading its contents.

The code reads the entire file content and checks if its length exceeds 1MB (1024*1024 bytes). If it does, it raises an HTTPException with status 400 and a message 'File too large'. So uploading a 2MB file triggers this error.

📝 Syntax

intermediate

Which option correctly validates file type as PNG?

You want to accept only PNG files in a FastAPI upload endpoint by checking the file's content type. Which code snippet correctly raises an error if the file is not a PNG?

FastAPI

from fastapi import FastAPI, File, UploadFile, HTTPException

app = FastAPI()

@app.post('/upload')
async def upload_file(file: UploadFile = File(...)):
    if ???:
        raise HTTPException(status_code=400, detail='Only PNG files allowed')
    return {'filename': file.filename}

A if file.content_type != 'image/png':

B if file.filename.endswith('.png'):

C if file.content_type == 'image/png':

D if file.content_type != 'application/png':

💡 Hint

Check the MIME type for PNG images.

The correct MIME type for PNG images is 'image/png'. The code should check if file.content_type is not equal to this to raise an error. Option A does this correctly.

🔧 Debug

advanced

Why does this file size validation fail to limit uploads?

This FastAPI code tries to reject files larger than 1MB but still accepts bigger files. What is the cause?

FastAPI

from fastapi import FastAPI, File, UploadFile, HTTPException

app = FastAPI()

@app.post('/upload')
async def upload_file(file: UploadFile = File(...)):
    if file.spool_max_size < 1024 * 1024:
        raise HTTPException(status_code=400, detail='File too large')
    return {'filename': file.filename}

A The code should use file.size instead of file.spool_max_size.

B file.spool_max_size gives the file size in kilobytes, so the check is wrong.

C The file size must be checked after reading the file contents, not before.

D file.spool_max_size is a configuration attribute, not the actual file size.

💡 Hint

Look up what spool_max_size means in UploadFile.

spool_max_size is a setting that controls the maximum size of file data kept in memory before spooling to disk. It is not the size of the uploaded file. To check file size, you must read the file contents and measure length.

❓ state_output

advanced

What is the output after uploading a valid JPEG file?

Given this FastAPI endpoint that accepts only PNG files and returns the filename and size, what is the output if a user uploads a JPEG file named 'photo.jpg' of 500KB?

FastAPI

from fastapi import FastAPI, File, UploadFile, HTTPException

app = FastAPI()

@app.post('/upload')
async def upload_file(file: UploadFile = File(...)):
    if file.content_type != 'image/png':
        raise HTTPException(status_code=400, detail='Only PNG files allowed')
    contents = await file.read()
    return {'filename': file.filename, 'size': len(contents)}

A Returns an empty JSON object {}.

B HTTP 400 error with detail 'Only PNG files allowed' is returned.

C Returns {'filename': 'photo.jpg', 'size': 0} because file.read() is not awaited.

D Returns {'filename': 'photo.jpg', 'size': 512000}.

💡 Hint

Check the content_type condition and what happens if it fails.

The code checks if the uploaded file's content type is not 'image/png'. Since the file is JPEG, it raises an HTTPException with status 400 and the message 'Only PNG files allowed'.

🧠 Conceptual

expert

Why is reading the entire file to check size not ideal in FastAPI?

In FastAPI, to validate file size, some code reads the entire file content with await file.read() and then checks length. Why might this approach be problematic for large files?

A File size can be checked from file.filename attribute without reading contents.

B FastAPI automatically limits file size, so manual size checks are redundant.

C Reading the entire file into memory can cause high memory use and slow response for large files.

D Reading file contents twice is required to validate size and type separately.

💡 Hint

Think about server resources and user experience with big uploads.

Reading the entire file into memory means the server holds all bytes at once. For large files, this can cause high memory consumption and slow down the server or even crash it. A better approach is to limit upload size at the server or stream the file in chunks.