I'm getting malformed multipart POST when I try to post data to remote API with C# HttpClient

Question

First of all my English is not good, sorry for any mistakes, I will try my best.

I'm trying to create a website with C# and ASP.NET Core 8. I should POST data to a remote API for uploading my videos (DoodStream API). When I try to post my data to the API using Postman or BurpSuite or a simple html form, I get back a HTTP 200 success response and my videos are visible on the dashboard.

But when I try to upload my videos with ASP.NET Core's HttpClient, I'm getting an error :

HTTP 500 - Malformed multipart POST

I've been trying to solve this problem for about a week now, but I couldn't.

This is the upload function:

public async Task<string> UploadDSAsync(string apiUrl, string apiKey, string filePath)
{
    using (var request = new HttpRequestMessage(HttpMethod.Post, $"{apiUrl}?key={apiKey}"))
    {
        using (var form = new MultipartFormDataContent())
        {                  
            var ua = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";
            request.Headers.Add("User-Agent", ua);

            var file = new ByteArrayContent(await File.ReadAllBytesAsync(filePath));

            file.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue("video/mp4");
            file.Headers.ContentDisposition = new System.Net.Http.Headers.ContentDispositionHeaderValue("form-data")
                    {
                        Name = "file",
                        FileName = Path.GetFileName(filePath)
                    };

            form.Add(new StringContent(apiKey), name: "api_key");
            form.Add(file, name: "file", Path.GetFileName(filePath));
                    
            request.Content = form;

            var response = _httpClient.Send(request);
            response.EnsureSuccessStatusCode();

            return await response.Content.ReadAsStringAsync();
        }
    }
}

[HttpPost]
[ValidateAntiForgeryToken]
[DisableRequestSizeLimit]
[Route("[controller]")] 
[RequestFormLimits(ValueLengthLimit = int.MaxValue, MultipartBodyLengthLimit = int.MaxValue)]
public async Task<IActionResult> Upload(IFormFile file)
{
    var url = $"https://doodapi.com/api/upload/server?key={apiKey}";
    var res = await _doodStreamService.GetUploadServerAsync(url);
//res equals the url value, doostream provide us different urls for post videos.

    if (res == null)
    {
        return BadRequest(res);
    }

    if (file == null || file.Length == 0)
    {
        return BadRequest("Dosya seçilmedi.");
    }

    var filePath = Path.GetTempFileName().Replace(".tmp", ".mp4");

    using (var stream = System.IO.File.Create(filePath))
    {
        await file.CopyToAsync(stream);
    }

    var result = await _doodStreamService.UploadDSAsync(res, apiKey, filePath);

    // Geçici dosyayı silin
    System.IO.File.Delete(filePath);

    return Ok(result);
}

I want to show you a successfully HTTP Post request.

POST /upload/01?key=mykey HTTP/1.1
Host: io274l.video-delivery.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:127.0) Gecko/20100101 Firefox/127.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------329310205013466975143905415842
Content-Length: 2789881
Origin: http://127.0.0.1:5500
Referer: http://127.0.0.1:5500/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Priority: u=1
Te: trailers
Connection: keep-alive

-----------------------------329310205013466975143905415842
Content-Disposition: form-data; name="api_key"

182790a84ywqe32dp5y9ty
-----------------------------329310205013466975143905415842
Content-Disposition: form-data; name="file"; filename="aaa.mp4"
Content-Type: video/mp4

ftypmp42mp42isomavc1Ímoovxmvhdâ$â$X@Ätrakhtkhdâ$â$@8,edts$elst»(mdia,mdhdâ$â$]ÀÃØUÄ:hdlrvideVimeo Artax Video Handlerºminfvmhd$dinfdrefurl zstbl²stsd¢avc18HH
AVC Codingÿÿ9avcCd*ÿágd*¬Ùx'å  pã3@hé{,ýøøcolrnclxstts8é`cttsê»ÒÒÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒ¤Ò»ÒÒÒÒÒÒÒv»éÒv»éÒv»éÒÒÒÒÒv»éÒ¤ÒÒÒÒÒÒÒ¤Ò»ÒÒÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒv»éÒv»éÒv»éÒÒÒÒÒ¤Ò»ÒÒÒÒÒÒÒv»éÒv»éÒv»éÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒ¤Ò¤é¤é¤é¤é¤é¤é¤é»é$stssIÙ!stscôstsz8õDE©Ç
3

MORE VİDEO BYTES
...
...

----------------------------329310205013466975143905415842--

It's returning http 200 and JSON data about the uploaded video.

And this is my other request in ASP.NET Core, but this is now returning http 500 and fails.

POST /upload/01?key=myapikey HTTP/1.1
Host: yu1073k.video-delivery.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
traceparent: 00-612759c4039f28f75b3b845b2154898f-c618443035899a1d-00
Content-Type: multipart/form-data; boundary="a0cc5a75-c0d5-4328-8007-6abab10c2ee5"
Content-Length: 2789859
Connection: keep-alive

--a0cc5a75-c0d5-4328-8007-6abab10c2ee5
Content-Type: text/plain; charset=utf-8
Content-Disposition: form-data; name=api_key

182790a84ywqe32dp5y9ty
--a0cc5a75-c0d5-4328-8007-6abab10c2ee5
Content-Type: video/mp4
Content-Disposition: form-data; name=file; filename=tmputfimX.mp4

ftypmp42mp42isomavc1Ímoovxmvhdâ$â$X@Ätrakhtkhdâ$â$@8,edts$elst»(mdia,mdhdâ$â$]ÀÃØUÄ:hdlrvideVimeo Artax Video Handlerºminfvmhd$dinfdrefurl zstbl²stsd¢avc18HH
AVC Codingÿÿ9avcCd*ÿágd*¬Ùx'å  pã3@hé{,ýøøcolrnclxstts8é`cttsê»ÒÒÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒ¤Ò»ÒÒÒÒÒÒÒv»éÒv»éÒv»éÒÒÒÒÒv»éÒ¤ÒÒÒÒÒÒÒ¤Ò»ÒÒÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒv»éÒv»éÒv»éÒÒÒÒÒ¤Ò»ÒÒÒÒÒÒÒv»éÒv»éÒv»éÒÒÒÒÒ¤Òv»éÒÒÒÒÒÒÒ¤Ò¤é¤é¤é¤é¤é¤é¤é»é$stssIÙ!stscôstsz8õDE©Ç
3!À}â`>ö´À$ÏDò ßþ!KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK¿BMORE BYTES
...

--a0cc5a75-c0d5-4328-8007-6abab10c2ee5--

By the way, in both http requests, the video bytes are correct, the problem is not about that.

Doodstream api local upload documentation

I tried multiple times with burpsuite and postman, it's returning http 200.

I want to upload it via my UploadDSAsync function.

Answer 1

I'm trying to create a website with C# and ASP.NET Core 8. I should POST data to a remote API for uploading my videos (DoodStream API). When I try to post my data to the API using Postman or BurpSuite or a simple html form, I get back a HTTP 200 success response and my videos are visible on the dashboard.

But when I try to upload my videos with ASP.NET Core's HttpClient, I'm getting an error :

HTTP 500 - Malformed multipart POST

Well based on your shared code snippet and description I have tried to reproduce your error and I found couple of issue within your code.

First of all, I found the Content-Disposition header for the file part (file) might not have been correctly formatted. The correct format should be "form-data; name="file"; filename="filename.ext"".

In your method this looks correct syntactically, but issues might arise if the server expects a slightly different format or if there's an issue with encoding special character.

Most importnatly, you add both the StringContent and ByteArrayContent to the MultipartFormDataContent.

But the problematic part is how you're adding the file content (file) to the MultipartFormDataContent (form). The correct way to add ByteArrayContent to MultipartFormDataContent is just form.Add(file).

Finally, within UploadDSAsync you were using Path.GetFileName(filePath) when adding the file to form, but I suspect this usage might not be correct. The correct way to add a file to MultipartFormDataContent form.Add(file, "file", Path.GetFileName(filePath)).

In order to fix that, I have tried in following way and its sending the the mp4 file accordingly to the API using UploadDSAsync method.

Let's have a look in practice:

Method for handling MultipartFormDataContent:

private async Task<string> UploadDSAsync(string url, string filePath)
{
    var httpClient = _httpClientFactory.CreateClient();
    var ua = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";

    using (var request = new HttpRequestMessage(HttpMethod.Post, url))
    {
        request.Headers.Add("User-Agent", ua);
        using (var form = new MultipartFormDataContent())
        {
            var fileContent = new ByteArrayContent(await System.IO.File.ReadAllBytesAsync(filePath));

            fileContent.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue("application/octet-stream");
            fileContent.Headers.ContentDisposition = new System.Net.Http.Headers.ContentDispositionHeaderValue("form-data")
            {
                Name = "file",
                FileName = Path.GetFileName(filePath)
            };

            form.Add(fileContent);

            request.Content = form;

            var response = await httpClient.SendAsync(request);
            response.EnsureSuccessStatusCode();

            return await response.Content.ReadAsStringAsync();
        }
    }
}

Note: As I am testing in local environment, so I have removed APIKey stuff.

Output:

Note: Please refer to this official document for additional assistance and sample.