I am building an application with Ruby on Rails that users can upload large files to the server.
To prevent CSRF, the client will POST the request with a token for CSRF protection.
For example:
Content-Type: multipart/form-data; boundary=---------------------------27677775382905058935599910838
-----------------------------27677775382905058935599910838
Content-Disposition: form-data; name="token"
t8rwe3udcaTwkJ3wqje1JThn
-----------------------------27677775382905058935599910838
Content-Disposition: form-data; name="file"; filename="blank.gif"
Content-Type: image/gif
<BINARY>
-----------------------------27677775382905058935599910838--
Unfortunately, the whole request body will be completely transmitted before Rails can verify the token. If the file is large, users would wait a long time then finally get a 401 Unauthorized response.
Is it possible to read request body chunk by chunk or even body part by body part so that server can respond with 401 Unauthorized as soon as it reads the CSRF token?