Manual testing guide
File Upload Test Cases: Type, Size and Security Coverage
File uploads combine usability, storage and security risks. Testing should verify the file itself—not only its name—while covering size boundaries, interrupted transfers and safe access after storage.
Example requirement
An authenticated user can upload an allowed file within the documented size limit. Invalid types, oversized files, malicious content and interrupted uploads must be handled safely.
Generate test cases for this example6
Test cases
4
Coverage types
5
High priority
CSV
Export format
6 example test cases
Filter the coverage, switch between card and table views, then copy or export the cases you need. Replace assumptions with the confirmed rules, environments and risks of your product.
Showing 6 of 6 cases
Upload a valid supported file
Precondition
The user is authorised and a supported file is available.
Expected result
The upload completes once, metadata is correct and the stored file can be accessed only as intended.
Steps
- 1.Choose the valid file
- 2.Start the upload
- 3.Open or download the stored result
Accept a file at the exact maximum size
Precondition
The documented maximum size is known.
Expected result
The file is accepted and processed without truncation or an incorrect size error.
Steps
- 1.Prepare a valid file exactly at the size limit
- 2.Upload the file
Reject a file above the maximum size
Precondition
A valid-format file one unit above the limit is available.
Expected result
The upload is blocked with a clear size message and no incomplete file remains accessible.
Steps
- 1.Choose the oversized file
- 2.Attempt the upload
Reject a renamed unsupported file
Precondition
An unsupported file renamed with an allowed extension is available.
Expected result
Content validation rejects the file and it is not stored or served as an allowed type.
Steps
- 1.Choose the disguised file
- 2.Attempt the upload
- 3.Inspect the stored-file list
Handle an interrupted upload
Precondition
A file upload is ready and connectivity can be interrupted.
Expected result
The failure is clear, partial content is cleaned up or isolated and the retry does not create unintended duplicates.
Steps
- 1.Start the upload
- 2.Interrupt connectivity before completion
- 3.Restore connectivity and retry
Store and serve uploaded files safely
Precondition
Security-approved test files and storage inspection are available.
Expected result
Names are normalised safely, access control is enforced and active content cannot execute unexpectedly.
Steps
- 1.Upload filenames containing spaces, Unicode and path-like characters
- 2.Attempt unauthorised access
- 3.Inspect returned headers and rendered behaviour
Coverage checklist
- Validate real file content and MIME type instead of trusting the extension.
- Test zero-byte, exact-limit and just-over-limit files.
- Confirm malware scanning and quarantine behaviour where required.
- Check access control for stored files, direct URLs and previews.
- Verify partial uploads and temporary files are cleaned up safely.
Related test case examples
Practical login page test cases covering valid access, invalid credentials, validation, accessibility, session handling and security risks.
Registration testingExample registration test cases for required fields, duplicate accounts, password rules, verification, accessibility and input boundaries.
Password reset testingPassword reset test cases covering OTP delivery, expiry, one-time use, password policy, account discovery and active-session behaviour.
Shopping cart testingShopping cart test cases covering add, remove, quantities, prices, stock, promotions, persistence, accessibility and concurrent updates.
Generate cases for your own requirement
Paste your real user story, choose the coverage categories and receive structured manual test cases you can review and export.
Open the free generator