Is there a buffer (size or number of files) limit in modern browsers that have implemented FormData and XmlHttpRequest?

Question

I'm implementing XmlHttpRequest and FormData for a new application on our site, and there's a concern that some customers may try to upload tens, or possibly, hundreds of thousands of documents at a time. Before I went through the painstaking effort of testing these conditions, I was hoping that someone knew if there was a limit on (1) the number of files that can be uploaded at once, and/or (2) if there is a file size limit in any of the modern browsers that have implemented these features.

Answer 1

1. The limit on the file size depends on data type used by the browser application to store the content length attribute (usually signed or unsigned int, or around 2GB/4GB). You can also impose a max file size limit in your server side code by checking the content length and rejecting the upload of it exceeds certain threshold.

2. The number of files which can be uploaded at once depends on the maximum number of connections allowed per domain. See this question for more info. So, all files will be uploaded, n at a time.

UPDATE:

I did some testing as I wasn't sure whether the browser streams the files from the file system straight into the TCP connection or buffers them in memory.

If I try to upload very big file from Chrome and FF through Fiddler, the memory usage of the browser process on my machine doesn't go up while the fiddler process increases to 2GB before it crashes (its a 32bit application).

So, if on the server you stream the content of the files directly into your data store, I don't think that you will run into memory issues on neither the client or the server.

Bear in mind that most web servers need to be configured to accept very large request.

Also, make sure you use one XmlHttpRequest instance per file. If you upload everything though a single connection the content-length will be set to the total size of all files.

Also, bear in mind that allowing big files to be uploaded will make your server vulnerable to DoS attacks (you probably know this already but I though its worth mentioning).