Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering what personal information the file input (<input type="file">) element gives the website.

I noticed that it does show the file name and the website does seem to have access to it. What about the file's path? If the file is located in My Documents, they could find out the user name via the path (e.g. C:\Documents and Settings\Bob\My Documents) which many times is the actual user's name that is using the website.

What information do most modern browsers allow the website to access when a user uses the file input element?

Could JavaScript somehow be used to gain more information?

What about when plugins (such as Flash or Java) implement file uploading?

share|improve this question
Depends a little on what information you consider personal... the tin-foil hats would say yes. Check out: – Chris S May 6 '10 at 23:14
I'm wondering about any information it gets. I know it gets the filename and the contents obviously, what other additional information does it get that a browser normally wouldn't get without the use of the INPUT element? – Senseful May 6 '10 at 23:15
up vote 1 down vote accepted

There's lots of information in the request your web browser sends, but the file input element is only contributing the filename and the file contents. When you submit a file via a file input element, the relevant part of the web browser's request looks something like this

Content-Disposition: form-data; name="f"; filename="file.txt"
Content-Type: application/octet-stream

followed by the actual contents of the file. (Note: Every form item has a name that was specified in the form and a value that the user entered or selected. In the request above, the file input element had the name f in the form.)

You're correct that the filename path might tell the server a little bit about you or your computer, like your username or folder names on your computer. I tested the web browsers on my computer and noticed the following:

  • Internet Explorer 7 sends the complete drive, path, and filename of the file. For example, "C:\folder\file.txt".
  • Chrome 4.0, Opera 10.01, and Firefox 3.0 just send the filename. For example, "file.txt".

(By the way, I used the Proxomitron proxy server on my own computer to view the requests my browsers were sending.)

share|improve this answer
Wow great info! The only other browser I would be interested in is Safari. – Senseful May 7 '10 at 5:25

You can use WireShark to view the packet as it goes to the server, and see all the wonderful information it sends.

This will show you

  • The Frame
  • The IP Header
  • The TCP Header
  • The HTTP Header (All cookies, settings, etc that's standard in ANY request to a browser)
  • The FormData (Encoded in name/value format) Key=Value&Key2=Value2&Key3=Value3
  • The actual file in a massive chunk right beneath that
share|improve this answer

No major browser is going to send anything behind your back, and they all severely limit what JavaScript is able to access. All bets are off when Flash and Java enter into the picture.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .