Why don’t file uploads work during AsynPostback

In AJAX-enabled pages, file uploads do not work when doing an async postback. To understand why the upload doesn't work it's important to understand how async postbacks are performed and how is that different from how the browser performs a regular postback.

When the browser performs a regular postback it has the benefit of being actual code with no security restrictions running on the client computer. When you submit a form it creates a web request with all the form fields. When it encounters an <input type="file"> it examines the file the user chose, reads it from disk, and adds it to the web request.

When the AJAX JavaScript code is running in the browser it can do the first part about creating a request with all the form fields. However, when it gets to <input type="file"> fields it doesn't have the necessary security permissions to read those files from disk. Imagine what would happen if it could read those files – a potential security threat.

So what's the workaround? Well, quite simply, the workaround is to do anything that doesn't involve a file upload during an async postback. Here are some solutions:

1. Have a dedicated "Upload" button that does a regular postback instead of an async postback. You can achieve this using several techniques: Have the button be outside all UpdatePanels; have the button be the target of an UpdatePanel's PostBackTrigger; or call ScriptManager.RegisterPostBackControl() on it.
2. Have a dedicated file upload page that doesn't have any UpdatePanels. Many web sites already do this anyway.

People have also come up with various workarounds and articles on how to trick UpdatePanel into allowing file uploads during async posts. Here is the link to one that uses some clever techniques that ASP .NET AJAX enables to reroute the requests - http://www.jeffzon.net/Blog/archive/2007/03/31/Let-UpdatePanel-support-file-uploading-Lets-Get-Started.aspx

Thanks & Regards,

Arun Manglick

SMTS || Microsoft Technology Practice || Bridgestone - Tyre Link || Persistent Systems || 3023-6258

DISCLAIMER ========== This e-mail may contain privileged and confidential information which is the property of Persistent Systems Pvt. Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you are not authorized to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Pvt. Ltd. does not accept any liability for virus infected mails.