Backend interview prep

Start

Spring MVC File Upload and Download Interview Questions and Answers

Master Spring MVC File Upload and Download with interview questions covering MultipartFile, multipart requests, file validation, streaming downloads, Resource, Content-Disposition, large file handling, cloud storage, and production best practices.

Introduction

File Upload and Download are among the most common requirements in enterprise applications.

Examples

  • Banking KYC document upload
  • Insurance claim attachments
  • Employee profile pictures
  • Medical reports
  • Invoice downloads
  • CSV/Excel imports
  • PDF statement generation

Spring MVC provides built-in support for handling multipart requests and streaming files efficiently.

A production-ready file handling solution must address

  • Validation
  • Security
  • Performance
  • Storage
  • Streaming
  • Virus scanning
  • Access control

File Upload & Download Architecture

flowchart LR

Client --> DispatcherServlet

DispatcherServlet --> Controller

Controller --> FileService

FileService --> LocalStorage

FileService --> CloudStorage

LocalStorage --> Response

CloudStorage --> Response

Response --> Client

Q1. What is MultipartFile?

Answer

MultipartFile is Spring MVC's abstraction for uploaded files.

It provides methods to

  • Read file content
  • Get file name
  • Get file size
  • Save files
  • Validate file type

Example

MultipartFile file

Q2. How do you upload a file?

Spring uses

@RequestParam

MultipartFile

Example

@PostMapping("/upload")

public String upload(

@RequestParam MultipartFile file){

}

Spring automatically parses multipart requests.

Q3. What is multipart/form-data?

Files are uploaded using

multipart/form-data

instead of

application/json

This allows

  • Files
  • Form fields
  • Metadata

to be sent together.

Q4. How do you validate uploaded files?

Typical validations

  • File size
  • Extension
  • MIME type
  • Empty file
  • Virus scan

Example

file.isEmpty()

Validation should happen before storing the file.

Q5. How do you download files?

Spring commonly returns

  • Resource
  • InputStreamResource
  • ByteArrayResource

Example

ResponseEntity<Resource>

Files are streamed to the client instead of loading everything into memory.

Q6. What is Content-Disposition?

This HTTP header controls how browsers handle files.

Example

Content-Disposition:

attachment;

filename=report.pdf

Browser behavior

  • Download
  • Open inline

depends on this header.

Q7. How do you stream large files?

Avoid

Read Entire File

↓

Memory

Preferred

flowchart LR

Disk --> Stream

Stream --> Client

Streaming reduces memory consumption.

Q8. Where should uploaded files be stored?

Options

  • Local File System
  • AWS S3
  • Azure Blob Storage
  • Google Cloud Storage
  • NAS
  • Database (small files only)

Large enterprise systems usually use object storage.

Q9. How do you secure file uploads?

Recommendations

  • Validate file type
  • Limit file size
  • Scan for malware
  • Rename uploaded files
  • Store outside web root
  • Restrict download access

Never trust the original filename.

Q10. File Upload Best Practices

Validate Every Upload

Never trust client input.

Stream Large Downloads

Avoid loading entire files into memory.

Generate Unique File Names

Prevent overwriting.

Store Metadata in Database

Track owner, size, type, and location.

Use Cloud Storage

Improve scalability.

Banking Example

flowchart TD

Customer --> UploadController

UploadController --> Validation

Validation --> VirusScan

VirusScan --> S3Storage

S3Storage --> MetadataDB

Only validated documents are stored.

Common Interview Questions

  • What is MultipartFile?
  • How do you upload files?
  • What is multipart/form-data?
  • How do you validate uploads?
  • How do you download files?
  • What is Content-Disposition?
  • How do you stream large files?
  • Where should files be stored?
  • How do you secure uploads?
  • File upload best practices?

Quick Revision

Topic Summary
MultipartFile Uploaded file abstraction
multipart/form-data File upload content type
@RequestParam Receive uploaded file
Resource File download abstraction
Content-Disposition Download behavior
Streaming Efficient file transfer
Validation File size/type checks
Virus Scan Security
Cloud Storage Scalable storage
Metadata Database tracking

Complete File Upload Lifecycle

sequenceDiagram
Client->>DispatcherServlet: Multipart Request
DispatcherServlet->>Controller: MultipartFile
Controller->>Validator: Validate File
Validator-->>Controller: Success
Controller->>VirusScanner: Scan
VirusScanner-->>Controller: Clean
Controller->>StorageService: Save
StorageService-->>Controller: File Location
Controller-->>Client: Upload Success

Production Example – Banking KYC Document Upload

A banking application allows customers to upload identity documents for KYC verification.

Requirements

  • Maximum file size: 10 MB

  • Allowed formats:

    • PDF
    • JPG
    • PNG

  • Virus scan before storage

  • Store documents in AWS S3

  • Save metadata in PostgreSQL

  • Return secure download URL

Workflow

  1. Customer uploads a passport copy.

  2. Spring converts the multipart request into a MultipartFile.

  3. Controller validates:

    • File size
    • Extension
    • MIME type

  4. Antivirus scans the file.

  5. Storage service uploads it to S3 using a generated UUID filename.

  6. Metadata (customer ID, original filename, storage key, upload time) is stored in PostgreSQL.

  7. The API returns a success response.

@PostMapping("/kyc/upload")
public ResponseEntity<String> upload(

        @RequestParam MultipartFile file){

    storageService.store(file);

    return ResponseEntity.ok("Uploaded");

}

flowchart LR

MobileApp --> MultipartRequest

MultipartRequest --> DispatcherServlet

DispatcherServlet --> UploadController

UploadController --> FileValidation

FileValidation --> VirusScanner

VirusScanner --> StorageService

StorageService --> AmazonS3

StorageService --> PostgreSQL

AmazonS3 --> UploadSuccess

UploadSuccess --> MobileApp

Production Example – File Download

A customer downloads a monthly account statement.

Workflow

  1. Customer requests:
/statements/2026-07.pdf
  1. Controller verifies authorization.
  2. Storage service retrieves the file.
  3. Spring streams the file using InputStreamResource.
  4. Browser receives the file with:
Content-Disposition: attachment

@GetMapping("/statements/{name}")
public ResponseEntity<Resource> download(

        @PathVariable String name){

    Resource resource =
            storageService.load(name);

    return ResponseEntity.ok()
            .header(
                "Content-Disposition",
                "attachment; filename=" + name)
            .body(resource);

}

Local Storage vs Database vs Cloud Storage

Storage Advantages Disadvantages Best Use Case
Local File System Fast, simple Not scalable Small internal applications
Database (BLOB) ACID transactions Large database growth Small files (<1 MB)
AWS S3 Highly scalable, durable Network dependency Enterprise applications
Azure Blob Storage Cloud-native Cloud costs Azure deployments
Google Cloud Storage High availability Cloud dependency GCP deployments

File Upload Security Checklist

Recommendation Reason
Validate file extension Prevent dangerous uploads
Validate MIME type Detect spoofed files
Limit file size Prevent DoS attacks
Rename uploaded files Avoid filename collisions
Store outside web root Prevent direct execution
Virus scan uploads Detect malware
Authorize downloads Prevent unauthorized access
Log upload/download events Auditing and compliance

Key Takeaways

  • MultipartFile is Spring MVC's primary abstraction for handling uploaded files.
  • File uploads require the multipart/form-data content type and are typically received using @RequestParam MultipartFile.
  • Always validate uploaded files for size, type, MIME type, and security before storing them.
  • Large file downloads should be streamed using Resource implementations instead of loading the entire file into memory.
  • Content-Disposition controls whether browsers download or display files inline.
  • Enterprise applications typically store large files in cloud object storage such as AWS S3 or Azure Blob Storage while keeping metadata in a relational database.
  • Secure file handling requires virus scanning, access control, unique filenames, and storage outside the web root.
  • Following these practices results in scalable, secure, and production-ready file upload and download capabilities in Spring MVC applications.