RFC 7578 / START HERE
Multipart forms, before the details
Returning Values from Forms: multipart/form-data. The name is a media type, not an acronym: multipart means the body contains separately described parts, and form-data carries named form values.
It packages text and file contents into one body. Boundary marker lines separate the parts; each part names its field and may describe a file or its character encoding. A web browser submitting an upload form is one common user of this transport-independent format.
Why it exists
A plain list of text values cannot describe several files, their individual types and repeated field values as clearly. RFC 7578 replaces RFC 2388 and specifies modern multipart/form-data framing, multiple-file, encoding and ordering rules. It does not define the form interface or make uploaded content safe.
A familiar example
A fictional form sends a note and two selected text files. The files travel in separate parts with the same field name, each with its own body. The receiver retains both values, checks the supplied metadata and contents, and chooses storage safely; boundaries do not provide encryption or trust.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Separate values with a boundaryA form body can carry several values. A boundary is a chosen marker that separates its parts; it is not a password or a label for the file type.→
- Name the part; distrust the filenameA part header connects its data to a form field. A supplied filename is metadata from the sender, not an instruction to choose a destination path.→
- Keep multiple files as separate partsOne field can contain several files. Repeating its name on separate parts preserves those files instead of flattening them into one value.→
- Decode text using its character encodingText is sent as bytes. A charset names the character encoding needed to turn those bytes back into text; the body format does not make every unnamed text part UTF-8.→
- Keep encoding and upload safety separateMultipart framing can carry binary data directly on HTTP. Filename encoding and part headers describe data; they do not encrypt it, authenticate it or make a file safe to execute.→
This introduction explains RFC 7578 (2015). Read the original RFC ↗