604

I want to ask a question about the multipart/form-data. In the HTTP header, I find that the Content-Type: multipart/form-data; boundary=???.

Is the ??? free to be defined by the user? Or is it generated from the HTML? Is it possible for me to define the ??? = abcdefg?

3

5 Answers 5

572

Is the ??? free to be defined by the user?

Yes.

or is it supplied by the HTML?

No. HTML has nothing to do with that. Read below.

Is it possible for me to define the ??? as abcdefg?

Yes.

If you want to send the following data to the web server:

name = John
age = 12

using application/x-www-form-urlencoded would be like this:

name=John&age=12

As you can see, the server knows that parameters are separated by an ampersand &. If & is required for a parameter value then it must be encoded.

So how does the server know where a parameter value starts and ends when it receives an HTTP request using multipart/form-data?

Using the boundary, similar to &.

For example:

--XXX
Content-Disposition: form-data; name="name"

John
--XXX
Content-Disposition: form-data; name="age"

12
--XXX--

In that case, the boundary value is XXX. You specify it in the Content-Type header so that the server knows how to split the data it receives.

So you need to:

  • Use a value that won't appear in the HTTP data sent to the server.

  • Be consistent and use the same value everywhere in the request message.

11
  • 94
    Yout have to add an extra "--" in the end of boundary. Jan 15, 2014 at 10:56
  • 24
    You can read it in documentation. Boundary ending have to have extra two hypens "--" Link: w3.org/TR/html401/interact/forms.html#h-17.13.4.2 Jan 15, 2014 at 21:38
  • 8
    Great answer. A boundary is just the 'key' to separate the multiple "parts" of a multipart payload. Normally something like '&' is enough to separate the variables but you need something more unique to separate the payloads within the payload. Mar 18, 2014 at 18:30
  • 5
    I think that the boundary value as declared in the Content-Type header will actually be -XXX--- because an extra "--" should be written when separating the parts (hence the ---XXX---) Mar 17, 2015 at 12:07
  • 3
    Would be clearer if you didn't include any dashes in the boundary, since that would clearly show which dashes are included because of the protocol.
    – Chet
    Feb 23, 2016 at 16:05
165

The answer to substance of the question is yes. You can use an arbitrary value for the boundary parameter as long as it is less than 70 bytes long and only contains 7-bit US-ASCII (printable) characters.

If you use one of multipart/* content types, you are actually required to specify the boundary parameter in the Content-Type header. Otherwise, in the case of an HTTP request, the server will be unable to parse the payload.

Unless you are absolutely certain that only the US-ASCII character set will be used in its payload, you may want to add a Content-Type header to each part, with the charset parameter set to UTF-8.

A few relevant excerpts from the RFC2046:

  • 4.1. Text Media Type

    A "charset" parameter may be used to indicate the character set of the body text for "text" subtypes, notably including the subtype "text/plain", which is a generic subtype for plain text.

  • 4.1.2. Charset Parameter

    A critical parameter that may be specified in the Content-Type field for "text/plain" data is the character set.

    Unlike some other parameter values, the values of the charset parameter are NOT case sensitive. The default character set, which must be assumed in the absence of a charset parameter, is US-ASCII.

  • 5.1. Multipart Media Type

    As stated in the definition of the Content-Transfer-Encoding field [RFC 2045], no encoding other than "7bit", "8bit", or "binary" is permitted for entities of type "multipart". The "multipart" boundary delimiters and header fields are always represented as 7bit US-ASCII in any case (though the header fields may encode non-US-ASCII header text as per RFC 2047) and data within the body parts can be encoded on a part-by-part basis, with Content-Transfer-Encoding fields for each appropriate body part.

    The Content-Type field for multipart entities requires one parameter, "boundary". The boundary delimiter line is then defined as a line consisting entirely of two hyphen characters ("-", decimal value 45) followed by the boundary parameter value from the Content-Type header field, optional linear whitespace, and a terminating CRLF.

    Boundary delimiters must not appear within the encapsulated material, and must be no longer than 70 characters, not counting the two leading hyphens.

    The boundary delimiter line following the last body part is a distinguished delimiter that indicates that no further body parts will follow. Such a delimiter line is identical to the previous delimiter lines, with the addition of two more hyphens after the boundary parameter value.

Here is an example using an arbitrary boundary:

Content-Type: multipart/form-data; boundary="yet another boundary"

--yet another boundary
Content-Disposition: form-data; name="foo"

bar
--yet another boundary
Content-Disposition: form-data; name="baz"

quux
--yet another boundary
Content-Disposition: form-data; name="feels"
Content-Type: text/plain; charset=utf-8

🤷
--yet another boundary--
3
  • 9
    I like this answer most because it quotes from RFC about how hyphens are specified.
    – Rick
    Mar 15, 2020 at 13:51
  • @Rick There's a valid reason for IETF to do that — although they all look pretty much the same, only one of the following four is the correct hyphen character: ˗ ‐ - ‑
    – antichris
    Mar 16, 2020 at 19:32
  • ha, when I said hypens, I mean your answer told me which hypens are defined in the standard. I was confused about which hypens are "client defined" and which are "specification defined"
    – Rick
    Mar 17, 2020 at 4:40
69

multipart/form-data contains boundary to separate name/value pairs. The boundary acts like a marker of each chunk of name/value pairs passed when a form gets submitted. The boundary is automatically added to a content-type of a request header.

The form with enctype="multipart/form-data" attribute will have a request header Content-Type : multipart/form-data; boundary --- WebKit193844043-h (browser generated vaue).

The payload passed looks something like this:

Content-Type: multipart/form-data; boundary=---WebKitFormBoundary7MA4YWxkTrZu0gW

    -----WebKitFormBoundary7MA4YWxkTrZu0gW
    Content-Disposition: form-data; name=”file”; filename=”captcha”
    Content-Type:

    -----WebKitFormBoundary7MA4YWxkTrZu0gW
    Content-Disposition: form-data; name=”action”

    submit
    -----WebKitFormBoundary7MA4YWxkTrZu0gW--

On the webservice side, it's consumed in @Consumes("multipart/form-data") form.

Beware, when testing your webservice using chrome postman, you need to check the form data option(radio button) and File menu from the dropdown box to send attachment. Explicit provision of content-type as multipart/form-data throws an error. Because boundary is missing as it overrides the curl request of post man to server with content-type by appending the boundary which works fine.

See RFC1341 sec7.2 The Multipart Content-Type

1
  • 1
    Is the value of the boundary generated on the fly for every request, or is it possible to determine it ahead of time?
    – OGreeni
    Sep 7, 2022 at 15:03
-6

we have to split our data. So, the server understands what we send.

1 Example: We split data

$email = $_POST['email'];
$p_id = $_POST['pid'];

2.Example: if We send JSON data ( With ) content type Multipart/form-data, we get a warning related to boundary

 $json = file_get_contents("php://input");
4
  • Suppose I am converting a json object to form data and passing the values to php with 'Content-Type': 'multipart/form-data' , so in this case what I have to do ? Adding $json = file_get_contents("php://input"); will work ? Right now I am getting success but getting empty row fields in db.
    – NoobCoder
    Jul 10, 2021 at 6:30
  • just take json obj and decode using json_decode than take single value and store in variable. my json : { "username":"xyz", "email":"[email protected]", } my php $json = file_get_contents("php://input"); $email = json_decode($json)->email; echo $email; @NoobCoder Jul 10, 2021 at 6:47
  • I am splitting data just like you posted -> ` $id = isset($_POST['field1']) ? $_POST['field1'] : ''; $id1 = isset($_POST['field2']) ? $_POST['field2'] : '';` and passing these $id to query. What if I make changes on POST call in js. Content-type I am using is mulipart/form-data
    – NoobCoder
    Jul 10, 2021 at 7:08
  • try application/json as content type @NoobCoder Jul 10, 2021 at 8:24
-6

use this

headers: {
    'content-type': 'application/x-www-form-urlencoded'
  }

for boundary error

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.