How to Correctly Test File Upload Limits

When developing a file upload feature for a web application, are you confident just because you set the limit to 10 MB? In reality, testing upload limits has many pitfalls, and failure to validate correctly can result in unexpected errors in production. This article explains how to accurately test upload limits using boundary value testing principles.

What is boundary value testing

Boundary Value Testing is one of the fundamental techniques in software testing. It is based on the empirical observation that bugs are more likely to occur near the boundaries of input values—at points such as "exactly at the limit," "one byte before the limit," and "one byte over the limit."

For file upload limit testing, you should prepare at least the following 3 test cases.

• File exactly at the limit — Verify that the upload succeeds
• File 1 byte smaller than the limit — Verify that it definitely succeeds
• File 1 byte larger than the limit — Verify that it is correctly rejected

Be Careful Not to Confuse MB and MiB

The most common mistake in upload limit testing is confusing MB (megabytes) with MiB (mebibytes).

• 1 MB = 1,000,000 bytes (decimal-based, SI unit)
• 1 MiB = 1,048,576 bytes (binary-based, IEC unit)

This difference is approximately 4.86%, with a 48,576-byte gap between 10MB and 10MiB. It is crucial to accurately understand which unit your server-side framework or cloud service uses. For example, when you specify upload_max_filesize as "10M" in PHP, it is interpreted as 10MiB (10,485,760 bytes). However, some CDNs and API gateways may treat it as 10MB (10,000,000 bytes).

Overhead of multipart/form-data

The multipart/form-data format used in file uploads includes overhead such as boundary strings, Content-Disposition headers, and line breaks in addition to the file body.

When the server's size limit check is performed on the entire request body, even if the file itself is below the limit, including overhead may cause it to exceed. Since Nginx's client_max_body_size restricts the size of the entire request body, caution is needed on this point.

# Nginx の設定例
client_max_body_size 10m;  # リクエストボディ全体の上限（MiB単位）

Double-check between front-end and back-end

During testing, verify that size checks are performed on both the frontend (JavaScript) and backend (server). If checking is only done on the frontend, it can be easily bypassed using developer tools or the curl command.

// フロントエンドでのサイズチェック例
const MAX_SIZE = 10 * 1024 * 1024; // 10 MiB
fileInput.addEventListener('change', (e) => {
    const file = e.target.files[0];
    if (file.size > MAX_SIZE) {
        alert('ファイルサイズが上限を超えています');
        e.target.value = '';
    }
});

Error message and UX confirmation

In boundary value testing, check not only whether the request succeeds or fails, but also the following points.

• Is a clear error message displayed when the limit is exceeded?
• Is the HTTP Status Code Appropriate (e.g., 413 Payload Too Large)
• Does the progress bar work correctly during large file uploads?
• Whether timeout handling is implemented correctly

How to obtain test files

Accurate boundary value testing requires test files with exact byte-level sizes. DevLab provides boundary value test files tailored to major upload limits.

• Boundary Value Test File List — Files matched to major service limits like Gmail (25MB), Discord (25MB), WordPress (10MB)
• 10MB Threshold Test Set — Three-file set covering exact, just-before, and just-after scenarios
• 25MB Threshold Test Set — For email attachments and chat tools

All files include MD5, SHA-1, and SHA-256 hash values, which you can use to verify integrity after download.

Summary

Testing file upload limits requires more than just "throwing a large file at it." You should understand the difference between MB and MiB, consider multipart overhead, and validate boundary values with byte-precise test files. By leveraging DevLab's boundary value test files, you can implement these tests efficiently.

❓ Frequently Asked Questions

Which test cases does boundary testing of an upload limit need?

Three at minimum: a file exactly at the limit (does it succeed?), one byte under it (does it reliably succeed?), and one byte over it (is it correctly rejected?).

What happens if I confuse MB with MiB when testing upload limits?

1 MB is 1,000,000 bytes and 1 MiB is 1,048,576 — a gap of about 4.86%. PHP reads 10M in upload_max_filesize as 10 MiB (10,485,760 bytes), while some CDNs and APIs treat the same figure as 10 MB (10,000,000). Know which convention the server uses before you test.

Does multipart/form-data overhead affect upload limit testing?

Yes. Settings that cap the whole request body, such as Nginx's client_max_body_size, include the boundary strings and Content-Disposition headers — a few hundred bytes — so a file that is itself under the limit can still push the request over it.