From 1e32024292fee39e0f9ed6898c01b7067c12b6e1 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 2 Jun 2025 13:42:34 -0600
Subject: [PATCH 1/5] working

---
 design/file-upload.md                         | 64 ++++++++++++
 java-http.ipr                                 | 15 +++
 .../fusionauth/http/FileUploadDisabled.java   | 24 +++++
 .../fusionauth/http/FileUploadException.java  | 24 +++++
 .../fusionauth/http/FileUploadTooLarge.java   | 29 ++++++
 .../http/MultipartRequestTooLarge.java        | 29 ++++++
 .../http/io/MultipartProcessor.java           | 40 ++++++++
 .../io/MultipartProcessorConfiguration.java   | 97 +++++++++++++++++++
 .../fusionauth/http/io/MultipartStream.java   | 91 ++++++++++++++++-
 .../fusionauth/http/server/HTTPRequest.java   | 18 +++-
 .../io/fusionauth/http/MultipartTest.java     |  7 +-
 11 files changed, 429 insertions(+), 9 deletions(-)
 create mode 100644 design/file-upload.md
 create mode 100644 src/main/java/io/fusionauth/http/FileUploadDisabled.java
 create mode 100644 src/main/java/io/fusionauth/http/FileUploadException.java
 create mode 100644 src/main/java/io/fusionauth/http/FileUploadTooLarge.java
 create mode 100644 src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java
 create mode 100644 src/main/java/io/fusionauth/http/io/MultipartProcessor.java
 create mode 100644 src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java

diff --git a/design/file-upload.md b/design/file-upload.md
new file mode 100644
index 0000000..261197d
--- /dev/null
+++ b/design/file-upload.md
@@ -0,0 +1,64 @@
+### File Upload
+
+
+
+### Use Cases
+1. Restrict file uploads  
+   - In a multi 
+2. Allow uploads all the time
+3. Allow uploads, mvc Action dependant
+4. Allow uploads, mvc Action dependant, delete on action completion.
+   - This means the action is responsible to:
+      - Move the file
+      - Tell us not to delete it
+
+
+
+### Examples
+
+### Spring Boot
+
+- https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/MultipartProperties.java
+
+`MultipartProperties.java`
+```java
+/**
+ * Whether to enable support of multipart uploads.
+ */
+private boolean enabled = true;
+
+/**
+ * Intermediate location of uploaded files.
+ */
+private String location;
+
+/**
+ * Max file size.
+ */
+private DataSize maxFileSize = DataSize.ofMegabytes(1);
+
+/**
+ * Max request size.
+ */
+private DataSize maxRequestSize = DataSize.ofMegabytes(10);
+
+/**
+ * Threshold after which files are written to disk.
+ */
+private DataSize fileSizeThreshold = DataSize.ofBytes(0);
+
+/**
+ * Whether to resolve the multipart request lazily at the time of file or parameter
+ * access.
+ */
+private boolean resolveLazily = false;
+```
+
+
+#### Summary
+- Accept Multi-Part
+- See ContentDisposition with a file, collect meta-data about the file, do not create a file yet.
+- Uses Servlet handling and "parses" the request if not set to lazily. This functionally does what we are doing, it writes all the files to disk.
+
+
+io.undertow.server.handlers.form.FormDataParser - has a `close()` method and deletes all files on close. 
diff --git a/java-http.ipr b/java-http.ipr
index 8a79f77..a093491 100644
--- a/java-http.ipr
+++ b/java-http.ipr
@@ -346,12 +346,14 @@
       </HTMLCodeStyleSettings>
       <JavaCodeStyleSettings>
         <option name="DO_NOT_WRAP_AFTER_SINGLE_ANNOTATION" value="true" />
+        <option name="BLANK_LINES_AROUND_FIELD_WITH_ANNOTATIONS" value="1" />
         <option name="CLASS_NAMES_IN_JAVADOC" value="3" />
         <option name="INSERT_INNER_CLASS_IMPORTS" value="true" />
         <option name="CLASS_COUNT_TO_USE_IMPORT_ON_DEMAND" value="9999" />
         <option name="NAMES_COUNT_TO_USE_IMPORT_ON_DEMAND" value="9999" />
         <option name="IMPORT_LAYOUT_TABLE">
           <value>
+            <package name="" withSubpackages="true" static="false" module="true" />
             <package name="javax" withSubpackages="true" static="false" />
             <package name="java" withSubpackages="true" static="false" />
             <emptyLine />
@@ -1397,4 +1399,17 @@
   <component name="VcsDirectoryMappings">
     <mapping directory="$PROJECT_DIR$" vcs="Git" />
   </component>
+  <component name="libraryTable">
+    <library name=".kts definition dependencies">
+      <CLASSES>
+        <root url="jar://$KOTLIN_BUNDLED$/lib/kotlin-reflect.jar!/" />
+        <root url="jar://$KOTLIN_BUNDLED$/lib/kotlin-script-runtime.jar!/" />
+        <root url="jar://$KOTLIN_BUNDLED$/lib/kotlin-stdlib.jar!/" />
+      </CLASSES>
+      <JAVADOC />
+      <SOURCES>
+        <root url="jar://$KOTLIN_BUNDLED$/lib/kotlin-stdlib-sources.jar!/" />
+      </SOURCES>
+    </library>
+  </component>
 </project>
\ No newline at end of file
diff --git a/src/main/java/io/fusionauth/http/FileUploadDisabled.java b/src/main/java/io/fusionauth/http/FileUploadDisabled.java
new file mode 100644
index 0000000..84a4e71
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/FileUploadDisabled.java
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http;
+
+/**
+ * Thrown when a file upload is requested and this feature has been disabled.
+ *
+ * @author Daniel DeGroff
+ */
+public class FileUploadDisabled extends FileUploadException {
+}
diff --git a/src/main/java/io/fusionauth/http/FileUploadException.java b/src/main/java/io/fusionauth/http/FileUploadException.java
new file mode 100644
index 0000000..571c2dd
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/FileUploadException.java
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http;
+
+/**
+ * Thrown due an error during file upload.
+ *
+ * @author Daniel DeGrof
+ */
+public abstract class FileUploadException extends RuntimeException {
+}
diff --git a/src/main/java/io/fusionauth/http/FileUploadTooLarge.java b/src/main/java/io/fusionauth/http/FileUploadTooLarge.java
new file mode 100644
index 0000000..9af01dd
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/FileUploadTooLarge.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http;
+
+/**
+ * Thrown when a file being uploaded exceeds the configured maximum size in bytes.
+ *
+ * @author Daniel DeGroff
+ */
+public class FileUploadTooLarge extends FileUploadException {
+  public final long maximumFileSize;
+
+  public FileUploadTooLarge(long maximumFileSize) {
+    this.maximumFileSize = maximumFileSize;
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java b/src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java
new file mode 100644
index 0000000..c6811a1
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http;
+
+/**
+ * Thrown when a multipart request exceeds the total configured maximum size.
+ *
+ * @author Daniel DeGroff
+ */
+public class MultipartRequestTooLarge extends RuntimeException {
+  public long maximumRequestSize;
+
+  public MultipartRequestTooLarge(long maximumRequestSize) {
+    this.maximumRequestSize = maximumRequestSize;
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartProcessor.java b/src/main/java/io/fusionauth/http/io/MultipartProcessor.java
new file mode 100644
index 0000000..0588a4a
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/io/MultipartProcessor.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http.io;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+
+import io.fusionauth.http.FileInfo;
+
+/**
+ * An HTTP request processor that can handle a <code>Content-Type: multipart/form-data</code>.
+ */
+public class MultipartProcessor {
+  private final MultipartProcessorConfiguration configuration;
+
+  public MultipartProcessor(MultipartProcessorConfiguration configuration) {
+    this.configuration = configuration;
+  }
+
+  public void process(final InputStream inputStream, Map<String, List<String>> parameters, List<FileInfo> files, byte[] boundary)
+      throws IOException {
+    MultipartStream stream = new MultipartStream(inputStream, boundary, configuration);
+    stream.process(parameters, files);
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java b/src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java
new file mode 100644
index 0000000..537e0e7
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2022-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http.io;
+
+/**
+ * Provides configuration to control the behavior of the {@link MultipartStream} parser, specifically around file uploads.
+ *
+ * @author Daniel DeGroff
+ */
+public class MultipartProcessorConfiguration {
+  private boolean fileUploadEnabled;
+
+  private long maxFileSize = 1024 * 1024; // 1 Megabyte
+
+  private long maxRequestSize = 10 * 1024 * 1024; // 10 Megabyte
+
+  // TODO : Daniel : Review : This was 1k, that seemed really small?
+  private int multipartBufferSize = 8 * 1024; // 8 Kilobyte
+
+  private String temporaryFileLocation = System.getProperty("java.io.tmpdir");
+
+  private String temporaryFilenamePrefix = "java-http";
+
+  private String temporaryFilenameSuffix = "file-upload";
+
+  public MultipartProcessorConfiguration() {
+  }
+
+  public long getMaxFileSize() {
+    return maxFileSize;
+  }
+
+  public void setMaxFileSize(long maxFileSize) {
+    this.maxFileSize = maxFileSize;
+  }
+
+  public long getMaxRequestSize() {
+    return maxRequestSize;
+  }
+
+  public void setMaxRequestSize(long maxRequestSize) {
+    this.maxRequestSize = maxRequestSize;
+  }
+
+  public int getMultipartBufferSize() {
+    return multipartBufferSize;
+  }
+
+  public void setMultipartBufferSize(int multipartBufferSize) {
+    this.multipartBufferSize = multipartBufferSize;
+  }
+
+  public String getTemporaryFileLocation() {
+    return temporaryFileLocation;
+  }
+
+  public void setTemporaryFileLocation(String temporaryFileLocation) {
+    this.temporaryFileLocation = temporaryFileLocation;
+  }
+
+  public String getTemporaryFilenamePrefix() {
+    return temporaryFilenamePrefix;
+  }
+
+  public void setTemporaryFilenamePrefix(String temporaryFilenamePrefix) {
+    this.temporaryFilenamePrefix = temporaryFilenamePrefix;
+  }
+
+  public String getTemporaryFilenameSuffix() {
+    return temporaryFilenameSuffix;
+  }
+
+  public void setTemporaryFilenameSuffix(String temporaryFilenameSuffix) {
+    this.temporaryFilenameSuffix = temporaryFilenameSuffix;
+  }
+
+  public boolean isFileUploadEnabled() {
+    return fileUploadEnabled;
+  }
+
+  public void setFileUploadEnabled(boolean fileUploadEnabled) {
+    this.fileUploadEnabled = fileUploadEnabled;
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartStream.java b/src/main/java/io/fusionauth/http/io/MultipartStream.java
index 4b71221..89e4b24 100644
--- a/src/main/java/io/fusionauth/http/io/MultipartStream.java
+++ b/src/main/java/io/fusionauth/http/io/MultipartStream.java
@@ -24,16 +24,21 @@
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 import io.fusionauth.http.FileInfo;
+import io.fusionauth.http.FileUploadDisabled;
+import io.fusionauth.http.FileUploadTooLarge;
 import io.fusionauth.http.HTTPValues.ContentTypes;
 import io.fusionauth.http.HTTPValues.ControlBytes;
 import io.fusionauth.http.HTTPValues.DispositionParameters;
 import io.fusionauth.http.HTTPValues.Headers;
+import io.fusionauth.http.MultipartRequestTooLarge;
 import io.fusionauth.http.ParseException;
 import io.fusionauth.http.server.RequestPreambleState;
 import io.fusionauth.http.util.HTTPTools;
@@ -49,18 +54,59 @@ public class MultipartStream {
 
   private final byte[] buffer;
 
+  private final MultipartProcessorConfiguration configuration;
+
   private final InputStream input;
 
   private int boundaryLength;
 
   private int boundaryStart;
 
+  private long bytesRead;
+
   private int current;
 
   private int end;
 
   private int partialBoundary;
 
+  /**
+   * Constructs a {@code MultipartStream} with a multipart processor configuration.
+   * <p>
+   * Note that the buffer must be at least big enough to contain the boundary string, plus 4 characters for CR/LF and double dash, plus at
+   * least one byte of data.  Too small a buffer size setting will degrade performance.
+   *
+   * @param input         The {@code InputStream} to serve as a data source.
+   * @param boundary      The token used for dividing the stream into {@code encapsulations}.
+   * @param configuration The configuration used to parse the stream.
+   * @throws IllegalArgumentException If the buffer size is too small
+   */
+  public MultipartStream(final InputStream input, final byte[] boundary, final MultipartProcessorConfiguration configuration) {
+    Objects.requireNonNull(input);
+    Objects.requireNonNull(boundary);
+    Objects.requireNonNull(configuration);
+    this.configuration = configuration;
+
+    int bufSize = configuration.getMultipartBufferSize();
+    // We prepend CR/LF to the boundary to chop trailing CRLF from body-data tokens.
+    if (bufSize < boundary.length * 2) {
+      throw new IllegalArgumentException("The buffer size specified for the MultipartStream is too small. Must be double the boundary length.");
+    }
+
+    this.input = input;
+    this.buffer = new byte[bufSize];
+    this.boundary = new byte[boundary.length + 4]; // CRLF--<boundary> (then we manually handle CRLF or --)
+    this.boundaryStart = 2; // Initially we start after the CRLF
+    this.boundaryLength = boundary.length + 2; // Initially we only analyze the boundary plus the dashes
+
+    // Set up the full boundary
+    System.arraycopy(ControlBytes.MultipartBoundaryPrefix, 0, this.boundary, 0, 4);
+    System.arraycopy(boundary, 0, this.boundary, 4, boundary.length);
+
+    current = 0;
+    end = 0;
+  }
+
   /**
    * Constructs a {@code MultipartStream} with a custom size buffer.
    * <p>
@@ -87,6 +133,9 @@ public MultipartStream(final InputStream input, final byte[] boundary, final int
     this.boundary = new byte[boundary.length + 4]; // CRLF--<boundary> (then we manually handle CRLF or --)
     this.boundaryStart = 2; // Initially we start after the CRLF
     this.boundaryLength = boundary.length + 2; // Initially we only analyze the boundary plus the dashes
+    // Take the defaults, but enable file uploads
+    this.configuration = new MultipartProcessorConfiguration();
+    this.configuration.setFileUploadEnabled(true);
 
     // Set up the full boundary
     System.arraycopy(ControlBytes.MultipartBoundaryPrefix, 0, this.boundary, 0, 4);
@@ -104,7 +153,8 @@ public MultipartStream(final InputStream input, final byte[] boundary, final int
    * @throws IOException    If any I/O operation failed.
    * @throws ParseException If the input is not a proper multipart body and could not be processed.
    */
-  public void process(Map<String, List<String>> parameters, List<FileInfo> files) throws IOException, ParseException {
+  public void process(Map<String, List<String>> parameters, List<FileInfo> files)
+      throws IOException, ParseException {
     // Initialize the buffer with enough bytes to analyze one boundary
     if (!reload(boundaryLength + 2)) {
       throw new ParseException("Invalid multipart body. The body is empty.");
@@ -294,7 +344,13 @@ private void readPart(Map<String, HeaderValue> headers, Map<String, List<String>
 
     PartProcessor processor;
     if (isFile) {
-      processor = new FilePartProcessor(contentTypeString, encoding, filename, name);
+      // TODO : Daniel : Fail. We could return a 400, but that means we need to try and drain the InputStream which could be very large.
+      //                       But maybe that is ok, this would be a server level configuration, so perhaps this is reasonable to fail hard.
+      if (!configuration.isFileUploadEnabled()) {
+        throw new FileUploadDisabled();
+      }
+
+      processor = new FilePartProcessor(contentTypeString, encoding, filename, name, configuration.getMaxFileSize());
     } else {
       processor = new ParameterPartProcessor(encoding);
     }
@@ -346,7 +402,15 @@ private boolean reload(int minimumToLoad) throws IOException {
 
     // Load until we have enough
     while (end - current < minimumToLoad) {
-      end += input.read(buffer, start, buffer.length - start);
+      int read = input.read(buffer, start, buffer.length - start);
+      // Keep track of all bytes read for this multipart stream. Fail if the length has been exceeded.
+      bytesRead += read;
+      if (configuration != null) {
+        if (bytesRead > configuration.getMaxRequestSize()) {
+          throw new MultipartRequestTooLarge(configuration.getMaxRequestSize());
+        }
+      }
+      end += read;
       if (end == -1) {
         return false;
       }
@@ -375,18 +439,23 @@ private class FilePartProcessor implements PartProcessor {
 
     private final String filename;
 
+    private final long maxFileSize;
+
     private final String name;
 
     private final OutputStream output;
 
     private final Path path;
 
-    private FilePartProcessor(String contentType, Charset encoding, String filename, String name) throws IOException {
+    private long bytesWritten;
+
+    private FilePartProcessor(String contentType, Charset encoding, String filename, String name, long maxFileSize) throws IOException {
       this.contentType = contentType;
       this.encoding = encoding;
       this.filename = filename;
       this.name = name;
-      this.path = Files.createTempFile("java-http", "file-upload");
+      this.maxFileSize = maxFileSize;
+      path = Files.createTempFile(Paths.get(configuration.getTemporaryFileLocation()), configuration.getTemporaryFilenamePrefix(), configuration.getTemporaryFilenameSuffix());
       this.output = Files.newOutputStream(this.path);
     }
 
@@ -397,6 +466,18 @@ public void close() throws IOException {
 
     @Override
     public void process(int start, int end) throws IOException {
+      int len = end - start;
+      bytesWritten += len;
+
+      // TODO : Daniel : Review : Is there a better place to do this? We can't do it while reading from the InputStream
+      //        because we could have one to many parts. We don't want to buffer before writing to the file, so I think we have to just
+      //        wait and keep track of how many bytes we have written to the file before failing?
+      // TODO : Daniel : Review : We have not kept track of the file we opened here, so we need to either add a file listener, and have someone
+      //        else delete the file, we could delete it here, or someone could catch this exception and review all in flight files and then delete?
+      if (bytesWritten > maxFileSize) {
+        throw new FileUploadTooLarge(maxFileSize);
+      }
+
       output.write(buffer, start, end - start);
     }
 
diff --git a/src/main/java/io/fusionauth/http/server/HTTPRequest.java b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
index 7a02f6a..9ddccb2 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPRequest.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
@@ -46,6 +46,7 @@
 import io.fusionauth.http.HTTPValues.Headers;
 import io.fusionauth.http.HTTPValues.TransferEncodings;
 import io.fusionauth.http.body.BodyException;
+import io.fusionauth.http.io.MultipartProcessor;
 import io.fusionauth.http.io.MultipartStream;
 import io.fusionauth.http.util.HTTPTools;
 import io.fusionauth.http.util.HTTPTools.HeaderValue;
@@ -74,6 +75,7 @@ public class HTTPRequest implements Buildable<HTTPRequest> {
 
   private final List<Locale> locales = new LinkedList<>();
 
+  // Note this is only used when a multipart processor is not provided.
   private final int multipartBufferSize;
 
   private final Map<String, List<String>> urlParameters = new HashMap<>();
@@ -104,6 +106,8 @@ public class HTTPRequest implements Buildable<HTTPRequest> {
 
   private String multipartBoundary;
 
+  private MultipartProcessor multipartProcessor;
+
   private String path = "/";
 
   private int port = -1;
@@ -352,9 +356,15 @@ public Map<String, List<String>> getFormData() {
         byte[] body = getBodyBytes();
         HTTPTools.parseEncodedData(body, 0, body.length, formData);
       } else if (isMultipart()) {
-        MultipartStream stream = new MultipartStream(inputStream, getMultipartBoundary().getBytes(), multipartBufferSize);
         try {
-          stream.process(formData, files);
+          if (multipartProcessor != null) {
+            multipartProcessor.process(inputStream, formData, files, multipartBoundary.getBytes());
+          } else {
+            // A multipart processor has not been set. The request will be parsed and processed without any configuration.
+            // TODO : Daniel : Review : We may want to just yank this code and either no-op or fail if a processor is not set.
+            MultipartStream stream = new MultipartStream(inputStream, multipartBoundary.getBytes(), multipartBufferSize);
+            stream.process(formData, files);
+          }
         } catch (IOException e) {
           throw new BodyException("Invalid multipart body.", e);
         }
@@ -658,6 +668,10 @@ public void setHeaders(String name, Collection<String> values) {
     }
   }
 
+  public void setMultiPartProcessor(MultipartProcessor multipartProcessor) {
+    this.multipartProcessor = multipartProcessor;
+  }
+
   public void setURLParameter(String name, String value) {
     setURLParameters(name, value);
   }
diff --git a/src/test/java/io/fusionauth/http/MultipartTest.java b/src/test/java/io/fusionauth/http/MultipartTest.java
index 87bc159..3bcec93 100644
--- a/src/test/java/io/fusionauth/http/MultipartTest.java
+++ b/src/test/java/io/fusionauth/http/MultipartTest.java
@@ -90,7 +90,10 @@ public void post(String scheme) throws Exception {
       URI uri = makeURI(scheme, "");
       var client = makeClient(scheme, null);
       var response = client.send(
-          HttpRequest.newBuilder().uri(uri).header(Headers.ContentType, "multipart/form-data; boundary=----WebKitFormBoundaryTWfMVJErBoLURJIe").POST(BodyPublishers.ofString(Body)).build(),
+          HttpRequest.newBuilder()
+                     .uri(uri)
+                     .header(Headers.ContentType, "multipart/form-data; boundary=----WebKitFormBoundaryTWfMVJErBoLURJIe")
+                     .POST(BodyPublishers.ofString(Body)).build(),
           r -> BodySubscribers.ofString(StandardCharsets.UTF_8)
       );
 
@@ -98,4 +101,4 @@ public void post(String scheme) throws Exception {
       assertEquals(response.body(), ExpectedResponse);
     }
   }
-}
\ No newline at end of file
+}

From 99bac29c37ce13c4df50f661027c747d12f1b196 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 2 Jun 2025 14:44:32 -0600
Subject: [PATCH 2/5] working

---
 output.txt                                    | 188 ++++++++++++++++++
 .../fusionauth/http/server/Configurable.java  |  16 ++
 .../http/server/HTTP11Processor.java          |   4 +-
 .../fusionauth/http/server/HTTPRequest.java   |  12 +-
 .../http/server/HTTPServerConfiguration.java  |  21 ++
 5 files changed, 239 insertions(+), 2 deletions(-)
 create mode 100644 output.txt

diff --git a/output.txt b/output.txt
new file mode 100644
index 0000000..28905f7
--- /dev/null
+++ b/output.txt
@@ -0,0 +1,188 @@
+
+
+
+Test failure
+-----------------
+Exception: AssertionError
+Message: expected [200] but found [500]
+
+HTTP Trace:
+1748894365379 Starting the HTTP server. Buckle up!
+1748894365379 HTTP server listening on port [4242]
+1748894365379 HTTP server started successfully
+1748894365382 (HTTPS-ACCEPT)
+1748894365382 Accepted connection from client [/127.0.0.1:60986]
+1748894365383 (R) Read
+1748894365383 (HTTPS-READ-BUFFER) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365383 Read [510] bytes from client
+1748894365383 (HTTPS-READ) java.nio.HeapByteBuffer[pos=0 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365383 (HTTPS-HANDSHAKE-UNWRAP) java.nio.HeapByteBuffer[pos=0 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365383 (HTTPS-HANDSHAKE-UNWRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365383 (HTTPS-HANDSHAKE-UNWRAP-AFTER) java.nio.HeapByteBuffer[pos=510 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365383 (HTTPS-HANDSHAKE-TASK) java.nio.HeapByteBuffer[pos=510 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365391 (HTTPS-HANDSHAKE-TASK-DONE) java.nio.HeapByteBuffer[pos=510 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead NEED_WRAP
+1748894365391 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=510 lim=510 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365391 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP-AFTER) java.nio.HeapByteBuffer[pos=127 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=0 lim=127 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 Wrote [127] bytes to the client
+1748894365391 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=127 lim=127 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWriting
+1748894365391 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP-AFTER) java.nio.HeapByteBuffer[pos=6 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=0 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 Wrote [6] bytes to the client
+1748894365391 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=6 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWriting
+1748894365391 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-WRAP-AFTER) java.nio.HeapByteBuffer[pos=3223 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=0 lim=3223 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365391 Wrote [3223] bytes to the client
+1748894365391 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=3223 lim=3223 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWriting
+1748894365391 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365392 (R) Read
+1748894365392 (HTTPS-READ-BUFFER) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365392 Read [6] bytes from client
+1748894365392 (HTTPS-READ) java.nio.HeapByteBuffer[pos=0 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365392 (HTTPS-HANDSHAKE-UNWRAP) java.nio.HeapByteBuffer[pos=0 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365392 (HTTPS-HANDSHAKE-UNWRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365392 (HTTPS-HANDSHAKE-UNWRAP-AFTER) java.nio.HeapByteBuffer[pos=6 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365392 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=6 lim=6 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 (R) Read
+1748894365393 (HTTPS-READ-BUFFER) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 Read [90] bytes from client
+1748894365393 (HTTPS-READ) java.nio.HeapByteBuffer[pos=0 lim=90 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 (HTTPS-HANDSHAKE-UNWRAP) java.nio.HeapByteBuffer[pos=0 lim=90 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 (HTTPS-HANDSHAKE-UNWRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=90 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 (HTTPS-HANDSHAKE-UNWRAP-AFTER) java.nio.HeapByteBuffer[pos=90 lim=90 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=90 lim=90 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeRead
+1748894365393 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365393 (HTTPS-HANDSHAKE-WRAP) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365393 (HTTPS-HANDSHAKE-WRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365393 (HTTPS-HANDSHAKE-WRAP-AFTER) java.nio.HeapByteBuffer[pos=2893 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365393 (HTTPS-HANDSHAKE-DONE) java.nio.HeapByteBuffer[pos=0 lim=2893 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWrite
+1748894365393 Wrote [2893] bytes to the client
+1748894365393 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=2893 lim=2893 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] HandshakeWriting
+1748894365393 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyRead
+1748894365393 (R) Read
+1748894365393 (HTTPS-READ-BUFFER) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyRead
+1748894365393 Read [554] bytes from client
+1748894365393 (HTTPS-READ) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=554 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyRead
+1748894365393 (HTTPS-DECRYPT-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=554 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyRead
+1748894365393 (HTTPS-DECRYPT-AFTER) java.nio.HeapByteBuffer[pos=554 lim=554 cap=16709] java.nio.HeapByteBuffer[pos=516 lim=16704 cap=16704] BodyRead
+1748894365393 (HTTPS-DECRYPT-COPY-TO-DELEGATE) java.nio.HeapByteBuffer[pos=554 lim=554 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=516 cap=16704] BodyRead
+1748894365393 (HTTPS-DECRYPT-COPY-TO-DELEGATE-COPIED) java.nio.HeapByteBuffer[pos=554 lim=554 cap=16709] java.nio.HeapByteBuffer[pos=516 lim=516 cap=16704] BodyRead
+1748894365393 (R)
+1748894365393 (RP)
+1748894365393 Preamble successfully parsed
+1748894365393 Client indicated it was sending an entity-body in the request
+1748894365393 Handling body using Content-Length header 303
+1748894365393 (BODY) java.nio.HeapByteBuffer[pos=0 lim=303 cap=16384] 303
+1748894365393 (RWo)
+1748894365393 (RC)
+1748894365393 (RR)
+1748894365393 (HTTPS-DECRYPT-COPY-TO-DELEGATE-DONE) java.nio.HeapByteBuffer[pos=554 lim=554 cap=16709] java.nio.HeapByteBuffer[pos=516 lim=516 cap=16704] BodyRead Write
+1748894365393 (HTTPS-READ-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365393 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 HTTP worker threw an exception while processing a request
+java.lang.NullPointerException
+	at java.base/java.util.Objects.requireNonNull(Objects.java:209)
+	at io.fusionauth.http.io.MultipartStream.<init>(MultipartStream.java:87)
+	at io.fusionauth.http.io.MultipartProcessor.process(MultipartProcessor.java:37)
+	at io.fusionauth.http.server.HTTPRequest.getFormData(HTTPRequest.java:371)
+	at io.fusionauth.http.MultipartTest.lambda$post$0(MultipartTest.java:62)
+	at io.fusionauth.http.server.HTTPWorker.run(HTTPWorker.java:50)
+	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
+	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
+	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
+	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
+	at java.base/java.lang.Thread.run(Thread.java:833)
+
+1748894365394 (F)
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 The server (via a worker thread or the server due to an Expect request) has bytes to write or has closed the stream, but the preamble hasn't been sent yet. Generating preamble
+1748894365394 Preamble is [67] bytes long
+1748894365394 Preamble is [
+HTTP/1.1 500 Failure
+content-length: 0
+connection: keep-alive
+
+
+]
+1748894365394 Still writing preamble
+1748894365394 (HTTPS-ENCRYPT-CLEAR) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT-WRAP-BEFORE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT-WRAP-AFTER) java.nio.HeapByteBuffer[pos=105 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite OK
+1748894365394 Wrote [105] bytes to the client
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWriting
+1748894365394 (W)
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-WRITE-BUFFERS) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (HTTPS-ENCRYPT) java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 No more bytes from worker thread. Changing state to [KeepAlive]
+1748894365394 (HTTPS-WROTE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] BodyWrite
+1748894365394 (WKA)
+1748894365394 (HTTPS-WROTE-DONE) java.nio.HeapByteBuffer[pos=0 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=105 lim=105 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] Reset
+1748894365394 HTTP server shutdown requested. Attempting to close each listener. This could take a while.
+1748894365394 Closing connection to client [/127.0.0.1:60986]
+1748894365394 (HTTPS-CLOSE) false false
+1748894365394 (C)
+1748894365394 (HTTPS-CLOSE) false true java.nio.HeapByteBuffer[pos=40 lim=16709 cap=16709] java.nio.HeapByteBuffer[pos=0 lim=16704 cap=16704] CLOSED NOT_HANDSHAKING HandshakeWrite
+1748894365394 (HTTP-SERVER-CLOSE-WRITE)
+1748894365394 (C)
+1748894365394 HTTP server shutdown successfully.
+-----------------
diff --git a/src/main/java/io/fusionauth/http/server/Configurable.java b/src/main/java/io/fusionauth/http/server/Configurable.java
index 7ec9c80..4914052 100644
--- a/src/main/java/io/fusionauth/http/server/Configurable.java
+++ b/src/main/java/io/fusionauth/http/server/Configurable.java
@@ -18,6 +18,7 @@
 import java.nio.file.Path;
 import java.time.Duration;
 
+import io.fusionauth.http.io.MultipartProcessorConfiguration;
 import io.fusionauth.http.log.LoggerFactory;
 import io.fusionauth.http.log.SystemOutLoggerFactory;
 
@@ -194,12 +195,27 @@ default T withMinimumWriteThroughput(long bytesPerSecond) {
    *
    * @param multipartBufferSize The size of the buffer.
    * @return This.
+   * @deprecated use the configuration found in {@link MultipartProcessorConfiguration} instead.
    */
+  @Deprecated
   default T withMultipartBufferSize(int multipartBufferSize) {
     configuration().withMultipartBufferSize(multipartBufferSize);
     return (T) this;
   }
 
+  /**
+   * Sets the multipart processor configuration.
+   * <p>
+   * This configuration is used when parsing a multipart HTTP request that includes files.
+   *
+   * @param multipartProcessorConfiguration The configuration.
+   * @return This
+   */
+  default T withMultipartConfiguration(MultipartProcessorConfiguration multipartProcessorConfiguration) {
+    configuration().withMultipartConfiguration(multipartProcessorConfiguration);
+    return (T) this;
+  }
+
   /**
    * Sets the number of worker threads that will handle requests coming into the HTTP server. Defaults to 40.
    * <p>
diff --git a/src/main/java/io/fusionauth/http/server/HTTP11Processor.java b/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
index 1da2f2d..d2ac029 100644
--- a/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
+++ b/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
@@ -21,6 +21,7 @@
 import java.util.concurrent.Future;
 
 import io.fusionauth.http.io.BlockingByteBufferOutputStream;
+import io.fusionauth.http.io.MultipartProcessor;
 import io.fusionauth.http.log.Logger;
 import io.fusionauth.http.util.ThreadPool;
 
@@ -73,7 +74,8 @@ public HTTP11Processor(HTTPServerConfiguration configuration, HTTPListenerConfig
     this.threadPool = threadPool;
     this.state = ProcessorState.Read;
 
-    this.request = new HTTPRequest(configuration.getContextPath(), configuration.getMultipartBufferSize(), listener.isTLS() ? "https" : "http", listener.getPort(), ipAddress);
+    this.request = new HTTPRequest(configuration.getContextPath(), listener.isTLS() ? "https" : "http", listener.getPort(), ipAddress);
+    this.request.setMultiPartProcessor(new MultipartProcessor(configuration.getMultipartProcessorConfiguration()));
     this.requestProcessor = new HTTPRequestProcessor(configuration, request);
 
     BlockingByteBufferOutputStream outputStream = new BlockingByteBufferOutputStream(notifier, configuration.getResponseBufferSize(), configuration.getMaxOutputBufferQueueLength());
diff --git a/src/main/java/io/fusionauth/http/server/HTTPRequest.java b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
index 9ddccb2..f98ed96 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPRequest.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
@@ -123,7 +123,7 @@ public HTTPRequest() {
     this.multipartBufferSize = 1024;
   }
 
-  public HTTPRequest(String contextPath, int multipartBufferSize, String scheme, int port, String ipAddress) {
+  public HTTPRequest(String contextPath, @Deprecated int multipartBufferSize, String scheme, int port, String ipAddress) {
     Objects.requireNonNull(contextPath);
     Objects.requireNonNull(scheme);
     this.contextPath = contextPath;
@@ -133,6 +133,16 @@ public HTTPRequest(String contextPath, int multipartBufferSize, String scheme, i
     this.ipAddress = ipAddress;
   }
 
+  public HTTPRequest(String contextPath, String scheme, int port, String ipAddress) {
+    Objects.requireNonNull(contextPath);
+    Objects.requireNonNull(scheme);
+    this.contextPath = contextPath;
+    this.multipartBufferSize = 1024;
+    this.scheme = scheme;
+    this.port = port;
+    this.ipAddress = ipAddress;
+  }
+
   public void addAcceptEncoding(String encoding) {
     this.acceptEncodings.add(encoding);
   }
diff --git a/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java b/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
index 1307552..3a63962 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
@@ -21,6 +21,7 @@
 import java.util.List;
 import java.util.Objects;
 
+import io.fusionauth.http.io.MultipartProcessorConfiguration;
 import io.fusionauth.http.log.LoggerFactory;
 import io.fusionauth.http.log.SystemOutLoggerFactory;
 
@@ -58,6 +59,8 @@ public class HTTPServerConfiguration implements Configurable<HTTPServerConfigura
 
   private int multipartBufferSize = 16 * 1024;
 
+  private MultipartProcessorConfiguration multipartProcessorConfiguration;
+
   private int numberOfWorkerThreads = 40;
 
   private int preambleBufferSize = 16 * 1024;
@@ -148,10 +151,20 @@ public long getMinimumWriteThroughput() {
     return minimumWriteThroughput;
   }
 
+  // Use the configuration found in the MultipartProcessorConfiguration instead.
+  @Deprecated
   public int getMultipartBufferSize() {
     return multipartBufferSize;
   }
 
+  /**
+   *
+   * @return the multipart processor configuration.
+   */
+  public MultipartProcessorConfiguration getMultipartProcessorConfiguration() {
+    return multipartProcessorConfiguration;
+  }
+
   /**
    * The number of worker threads. This configuration will affect the runtime memory requirement.
    * <p>
@@ -368,6 +381,14 @@ public HTTPServerConfiguration withMultipartBufferSize(int multipartBufferSize)
     return this;
   }
 
+  @Override
+  public HTTPServerConfiguration withMultipartConfiguration(MultipartProcessorConfiguration multipartProcessorConfiguration) {
+    Objects.requireNonNull(multipartProcessorConfiguration, "You cannot set the multipart processor configuration to null");
+
+    this.multipartProcessorConfiguration = multipartProcessorConfiguration;
+    return this;
+  }
+
   /**
    * {@inheritDoc}
    */

From 2ed100a2fa742a8fe471ca4880a04b019bdaea47 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Tue, 10 Jun 2025 18:51:19 -0600
Subject: [PATCH 3/5] Working

---
 java-http.ipr                                 |  25 +++
 ...uestTooLarge.java => ContentTooLarge.java} |   7 +-
 .../fusionauth/http/FileUploadDisabled.java   |  24 ---
 .../fusionauth/http/FileUploadException.java  |  24 ---
 .../http/HTTPProcessingException.java         |  44 +++++
 ...ava => UnprocessableContentException.java} |  10 +-
 .../http/io/DefaultMultipartFileManager.java  |  41 +++++
 .../http/io/MultipartConfiguration.java       | 141 +++++++++++++++
 .../http/io/MultipartFileManager.java         |  37 ++++
 .../io/MultipartProcessorConfiguration.java   |  97 ----------
 .../fusionauth/http/io/MultipartStream.java   |  95 ++++------
 ...sor.java => MultipartStreamProcessor.java} |  23 ++-
 .../fusionauth/http/server/Configurable.java  |  10 +-
 .../http/server/HTTP11Processor.java          |  34 +++-
 .../fusionauth/http/server/HTTPRequest.java   |  31 ++--
 .../http/server/HTTPResponseProcessor.java    |   7 +-
 .../http/server/HTTPServerConfiguration.java  |  17 +-
 .../io/fusionauth/http/server/HTTPWorker.java |  26 ++-
 .../java/io/fusionauth/http/BaseTest.java     |   4 +-
 .../io/fusionauth/http/MultipartTest.java     | 170 +++++++++++++++++-
 .../http/io/MultipartStreamTest.java          |  36 +++-
 21 files changed, 625 insertions(+), 278 deletions(-)
 rename src/main/java/io/fusionauth/http/{MultipartRequestTooLarge.java => ContentTooLarge.java} (74%)
 delete mode 100644 src/main/java/io/fusionauth/http/FileUploadDisabled.java
 delete mode 100644 src/main/java/io/fusionauth/http/FileUploadException.java
 create mode 100644 src/main/java/io/fusionauth/http/HTTPProcessingException.java
 rename src/main/java/io/fusionauth/http/{FileUploadTooLarge.java => UnprocessableContentException.java} (71%)
 create mode 100644 src/main/java/io/fusionauth/http/io/DefaultMultipartFileManager.java
 create mode 100644 src/main/java/io/fusionauth/http/io/MultipartConfiguration.java
 create mode 100644 src/main/java/io/fusionauth/http/io/MultipartFileManager.java
 delete mode 100644 src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java
 rename src/main/java/io/fusionauth/http/io/{MultipartProcessor.java => MultipartStreamProcessor.java} (53%)

diff --git a/java-http.ipr b/java-http.ipr
index a093491..ec72a95 100644
--- a/java-http.ipr
+++ b/java-http.ipr
@@ -1396,6 +1396,31 @@
   <component name="ProjectRootManager" version="2" languageLevel="JDK_17" default="true" project-jdk-name="Java 17" project-jdk-type="JavaSDK">
     <output url="file://$PROJECT_DIR$/out" />
   </component>
+  <component name="ProjectRunConfigurationManager">
+    <configuration default="true" type="TestNG">
+      <shortenClasspath name="NONE" />
+      <useClassPathOnly />
+      <option name="SUITE_NAME" value="" />
+      <option name="PACKAGE_NAME" value="" />
+      <option name="MAIN_CLASS_NAME" value="" />
+      <option name="GROUP_NAME" value="" />
+      <option name="TEST_OBJECT" value="CLASS" />
+      <option name="VM_PARAMETERS" value="-ea --add-exports java.base/sun.security.x509=ALL-UNNAMED --add-exports java.base/sun.security.util=ALL-UNNAMED --add-opens java.base/java.net=ALL-UNNAMED" />
+      <option name="PARAMETERS" value="" />
+      <option name="OUTPUT_DIRECTORY" value="" />
+      <option name="TEST_SEARCH_SCOPE">
+        <value defaultName="moduleWithDependencies" />
+      </option>
+      <option name="PROPERTIES_FILE" value="" />
+      <properties />
+      <listeners>
+        <listener class="io.fusionauth.http.BaseTest$TestListener" />
+      </listeners>
+      <method v="2">
+        <option name="Make" enabled="true" />
+      </method>
+    </configuration>
+  </component>
   <component name="VcsDirectoryMappings">
     <mapping directory="$PROJECT_DIR$" vcs="Git" />
   </component>
diff --git a/src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java b/src/main/java/io/fusionauth/http/ContentTooLarge.java
similarity index 74%
rename from src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java
rename to src/main/java/io/fusionauth/http/ContentTooLarge.java
index c6811a1..1db90d2 100644
--- a/src/main/java/io/fusionauth/http/MultipartRequestTooLarge.java
+++ b/src/main/java/io/fusionauth/http/ContentTooLarge.java
@@ -16,14 +16,15 @@
 package io.fusionauth.http;
 
 /**
- * Thrown when a multipart request exceeds the total configured maximum size.
+ * Thrown when a request exceeds the total configured maximum size.
  *
  * @author Daniel DeGroff
  */
-public class MultipartRequestTooLarge extends RuntimeException {
+public class ContentTooLarge extends HTTPProcessingException {
   public long maximumRequestSize;
 
-  public MultipartRequestTooLarge(long maximumRequestSize) {
+  public ContentTooLarge(long maximumRequestSize, String detailedMessage) {
+    super(413, "Content Too Large", detailedMessage);
     this.maximumRequestSize = maximumRequestSize;
   }
 }
diff --git a/src/main/java/io/fusionauth/http/FileUploadDisabled.java b/src/main/java/io/fusionauth/http/FileUploadDisabled.java
deleted file mode 100644
index 84a4e71..0000000
--- a/src/main/java/io/fusionauth/http/FileUploadDisabled.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (c) 2025, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-package io.fusionauth.http;
-
-/**
- * Thrown when a file upload is requested and this feature has been disabled.
- *
- * @author Daniel DeGroff
- */
-public class FileUploadDisabled extends FileUploadException {
-}
diff --git a/src/main/java/io/fusionauth/http/FileUploadException.java b/src/main/java/io/fusionauth/http/FileUploadException.java
deleted file mode 100644
index 571c2dd..0000000
--- a/src/main/java/io/fusionauth/http/FileUploadException.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (c) 2025, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-package io.fusionauth.http;
-
-/**
- * Thrown due an error during file upload.
- *
- * @author Daniel DeGrof
- */
-public abstract class FileUploadException extends RuntimeException {
-}
diff --git a/src/main/java/io/fusionauth/http/HTTPProcessingException.java b/src/main/java/io/fusionauth/http/HTTPProcessingException.java
new file mode 100644
index 0000000..bd5d2a1
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/HTTPProcessingException.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http;
+
+/**
+ * A base HTTP processing exception that is able to suggest a status code to return the client.
+ */
+public abstract class HTTPProcessingException extends RuntimeException {
+  protected final int status;
+
+  protected final String statusMessage;
+
+  protected HTTPProcessingException(int status, String statusMessage) {
+    this.status = status;
+    this.statusMessage = statusMessage;
+  }
+
+  protected HTTPProcessingException(int status, String statusMessage, String detailedMessage) {
+    super(detailedMessage);
+    this.status = status;
+    this.statusMessage = statusMessage;
+  }
+
+  public int getStatus() {
+    return status;
+  }
+
+  public String getStatusMessage() {
+    return statusMessage;
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/FileUploadTooLarge.java b/src/main/java/io/fusionauth/http/UnprocessableContentException.java
similarity index 71%
rename from src/main/java/io/fusionauth/http/FileUploadTooLarge.java
rename to src/main/java/io/fusionauth/http/UnprocessableContentException.java
index 9af01dd..bfc2679 100644
--- a/src/main/java/io/fusionauth/http/FileUploadTooLarge.java
+++ b/src/main/java/io/fusionauth/http/UnprocessableContentException.java
@@ -16,14 +16,12 @@
 package io.fusionauth.http;
 
 /**
- * Thrown when a file being uploaded exceeds the configured maximum size in bytes.
+ * Thrown when a multipart request cannot be parsed because a processor was not specified.
  *
  * @author Daniel DeGroff
  */
-public class FileUploadTooLarge extends FileUploadException {
-  public final long maximumFileSize;
-
-  public FileUploadTooLarge(long maximumFileSize) {
-    this.maximumFileSize = maximumFileSize;
+public class UnprocessableContentException extends HTTPProcessingException {
+  public UnprocessableContentException(String message) {
+    super(422, "Unprocessable Content", message);
   }
 }
diff --git a/src/main/java/io/fusionauth/http/io/DefaultMultipartFileManager.java b/src/main/java/io/fusionauth/http/io/DefaultMultipartFileManager.java
new file mode 100644
index 0000000..103d01d
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/io/DefaultMultipartFileManager.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http.io;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Manage file creation for multipart streams.
+ *
+ * @author Daniel DeGroff
+ */
+public class DefaultMultipartFileManager implements MultipartFileManager {
+  private final List<Path> tempFiles = new ArrayList<>(0);
+
+  public Path createTemporaryFile(Path tempDir, String optionalPrefix, String optionalSuffix) throws IOException {
+    Path tempFile = Files.createTempFile(tempDir, optionalPrefix, optionalSuffix);
+    tempFiles.add(tempFile);
+    return tempFile;
+  }
+
+  public List<Path> getTemporaryFiles() {
+    return List.copyOf(tempFiles);
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartConfiguration.java b/src/main/java/io/fusionauth/http/io/MultipartConfiguration.java
new file mode 100644
index 0000000..ae0c1f1
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/io/MultipartConfiguration.java
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http.io;
+
+import java.util.Objects;
+
+/**
+ * Provides configuration to control the behavior of the {@link MultipartStream} parser, specifically around file uploads.
+ *
+ * @author Daniel DeGroff
+ */
+public class MultipartConfiguration {
+  private boolean deleteTemporaryFiles = true;
+
+  private boolean fileUploadEnabled;
+
+  private long maxFileSize = 1024 * 1024; // 1 Megabyte
+
+  private long maxRequestSize = 10 * 1024 * 1024; // 10 Megabyte
+
+  // TODO : Daniel : Review : This was 1k, that seemed really small?
+  private int multipartBufferSize = 8 * 1024; // 8 Kilobyte
+
+  private String temporaryFileLocation = System.getProperty("java.io.tmpdir");
+
+  private String temporaryFilenamePrefix = "java-http";
+
+  private String temporaryFilenameSuffix = "file-upload";
+
+  public MultipartConfiguration() {
+  }
+
+  public MultipartConfiguration(MultipartConfiguration other) {
+    this.fileUploadEnabled = other.fileUploadEnabled;
+    this.maxFileSize = other.maxFileSize;
+    this.maxRequestSize = other.maxRequestSize;
+    this.multipartBufferSize = other.multipartBufferSize;
+    this.temporaryFileLocation = other.temporaryFileLocation;
+    this.temporaryFilenamePrefix = other.temporaryFilenamePrefix;
+    this.temporaryFilenameSuffix = other.temporaryFilenameSuffix;
+  }
+
+  public boolean deleteTemporaryFiles() {
+    return deleteTemporaryFiles;
+  }
+
+  @Override
+  public boolean equals(Object o) {
+    if (o == null || getClass() != o.getClass()) {
+      return false;
+    }
+    MultipartConfiguration that = (MultipartConfiguration) o;
+    return fileUploadEnabled == that.fileUploadEnabled && maxFileSize == that.maxFileSize && maxRequestSize == that.maxRequestSize && multipartBufferSize == that.multipartBufferSize && Objects.equals(temporaryFileLocation, that.temporaryFileLocation) && Objects.equals(temporaryFilenamePrefix, that.temporaryFilenamePrefix) && Objects.equals(temporaryFilenameSuffix, that.temporaryFilenameSuffix);
+  }
+
+  public long getMaxFileSize() {
+    return maxFileSize;
+  }
+
+  public long getMaxRequestSize() {
+    return maxRequestSize;
+  }
+
+  public int getMultipartBufferSize() {
+    return multipartBufferSize;
+  }
+
+  public String getTemporaryFileLocation() {
+    return temporaryFileLocation;
+  }
+
+  public String getTemporaryFilenamePrefix() {
+    return temporaryFilenamePrefix;
+  }
+
+  public String getTemporaryFilenameSuffix() {
+    return temporaryFilenameSuffix;
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(fileUploadEnabled, maxFileSize, maxRequestSize, multipartBufferSize, temporaryFileLocation, temporaryFilenamePrefix, temporaryFilenameSuffix);
+  }
+
+  public boolean isFileUploadEnabled() {
+    return fileUploadEnabled;
+  }
+
+  public MultipartConfiguration withDeleteTemporaryFiles(boolean deleteTemporaryFiles) {
+    this.deleteTemporaryFiles = deleteTemporaryFiles;
+    return this;
+  }
+
+  public MultipartConfiguration withFileUploadEnabled(boolean fileUploadEnabled) {
+    this.fileUploadEnabled = fileUploadEnabled;
+    return this;
+  }
+
+  public MultipartConfiguration withMaxFileSize(long maxFileSize) {
+    this.maxFileSize = maxFileSize;
+    return this;
+  }
+
+  public MultipartConfiguration withMaxRequestSize(long maxRequestSize) {
+    this.maxRequestSize = maxRequestSize;
+    return this;
+  }
+
+  public MultipartConfiguration withMultipartBufferSize(int multipartBufferSize) {
+    this.multipartBufferSize = multipartBufferSize;
+    return this;
+  }
+
+  public MultipartConfiguration withTemporaryFileLocation(String temporaryFileLocation) {
+    this.temporaryFileLocation = temporaryFileLocation;
+    return this;
+  }
+
+  public MultipartConfiguration withTemporaryFilenamePrefix(String temporaryFilenamePrefix) {
+    this.temporaryFilenamePrefix = temporaryFilenamePrefix;
+    return this;
+  }
+
+  public MultipartConfiguration withTemporaryFilenameSuffix(String temporaryFilenameSuffix) {
+    this.temporaryFilenameSuffix = temporaryFilenameSuffix;
+    return this;
+  }
+}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartFileManager.java b/src/main/java/io/fusionauth/http/io/MultipartFileManager.java
new file mode 100644
index 0000000..ff988e4
--- /dev/null
+++ b/src/main/java/io/fusionauth/http/io/MultipartFileManager.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.http.io;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.List;
+
+public interface MultipartFileManager {
+  /**
+   * Create a temporary file for use when processing files in multipart form data.
+   *
+   * @param tempDir the path to the temporary directory
+   * @param optionalPrefix the optional prefix used to create the temporary file
+   * @param optionalSuffix the optional suffix used to create the temporary file
+   * @return the path to the temporary file
+   */
+  Path createTemporaryFile(Path tempDir, String optionalPrefix, String optionalSuffix) throws IOException;
+
+  /**
+   * @return a list of the temporary files created by this file manager.
+   */
+  List<Path> getTemporaryFiles();
+}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java b/src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java
deleted file mode 100644
index 537e0e7..0000000
--- a/src/main/java/io/fusionauth/http/io/MultipartProcessorConfiguration.java
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Copyright (c) 2022-2023, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-package io.fusionauth.http.io;
-
-/**
- * Provides configuration to control the behavior of the {@link MultipartStream} parser, specifically around file uploads.
- *
- * @author Daniel DeGroff
- */
-public class MultipartProcessorConfiguration {
-  private boolean fileUploadEnabled;
-
-  private long maxFileSize = 1024 * 1024; // 1 Megabyte
-
-  private long maxRequestSize = 10 * 1024 * 1024; // 10 Megabyte
-
-  // TODO : Daniel : Review : This was 1k, that seemed really small?
-  private int multipartBufferSize = 8 * 1024; // 8 Kilobyte
-
-  private String temporaryFileLocation = System.getProperty("java.io.tmpdir");
-
-  private String temporaryFilenamePrefix = "java-http";
-
-  private String temporaryFilenameSuffix = "file-upload";
-
-  public MultipartProcessorConfiguration() {
-  }
-
-  public long getMaxFileSize() {
-    return maxFileSize;
-  }
-
-  public void setMaxFileSize(long maxFileSize) {
-    this.maxFileSize = maxFileSize;
-  }
-
-  public long getMaxRequestSize() {
-    return maxRequestSize;
-  }
-
-  public void setMaxRequestSize(long maxRequestSize) {
-    this.maxRequestSize = maxRequestSize;
-  }
-
-  public int getMultipartBufferSize() {
-    return multipartBufferSize;
-  }
-
-  public void setMultipartBufferSize(int multipartBufferSize) {
-    this.multipartBufferSize = multipartBufferSize;
-  }
-
-  public String getTemporaryFileLocation() {
-    return temporaryFileLocation;
-  }
-
-  public void setTemporaryFileLocation(String temporaryFileLocation) {
-    this.temporaryFileLocation = temporaryFileLocation;
-  }
-
-  public String getTemporaryFilenamePrefix() {
-    return temporaryFilenamePrefix;
-  }
-
-  public void setTemporaryFilenamePrefix(String temporaryFilenamePrefix) {
-    this.temporaryFilenamePrefix = temporaryFilenamePrefix;
-  }
-
-  public String getTemporaryFilenameSuffix() {
-    return temporaryFilenameSuffix;
-  }
-
-  public void setTemporaryFilenameSuffix(String temporaryFilenameSuffix) {
-    this.temporaryFilenameSuffix = temporaryFilenameSuffix;
-  }
-
-  public boolean isFileUploadEnabled() {
-    return fileUploadEnabled;
-  }
-
-  public void setFileUploadEnabled(boolean fileUploadEnabled) {
-    this.fileUploadEnabled = fileUploadEnabled;
-  }
-}
diff --git a/src/main/java/io/fusionauth/http/io/MultipartStream.java b/src/main/java/io/fusionauth/http/io/MultipartStream.java
index 89e4b24..9228eda 100644
--- a/src/main/java/io/fusionauth/http/io/MultipartStream.java
+++ b/src/main/java/io/fusionauth/http/io/MultipartStream.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022-2023, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,15 +31,14 @@
 import java.util.Map;
 import java.util.Objects;
 
+import io.fusionauth.http.ContentTooLarge;
 import io.fusionauth.http.FileInfo;
-import io.fusionauth.http.FileUploadDisabled;
-import io.fusionauth.http.FileUploadTooLarge;
 import io.fusionauth.http.HTTPValues.ContentTypes;
 import io.fusionauth.http.HTTPValues.ControlBytes;
 import io.fusionauth.http.HTTPValues.DispositionParameters;
 import io.fusionauth.http.HTTPValues.Headers;
-import io.fusionauth.http.MultipartRequestTooLarge;
 import io.fusionauth.http.ParseException;
+import io.fusionauth.http.UnprocessableContentException;
 import io.fusionauth.http.server.RequestPreambleState;
 import io.fusionauth.http.util.HTTPTools;
 import io.fusionauth.http.util.HTTPTools.HeaderValue;
@@ -54,10 +53,12 @@ public class MultipartStream {
 
   private final byte[] buffer;
 
-  private final MultipartProcessorConfiguration configuration;
-
   private final InputStream input;
 
+  private final MultipartConfiguration multipartConfiguration;
+
+  private final MultipartFileManager multipartFileManager;
+
   private int boundaryLength;
 
   private int boundaryStart;
@@ -76,53 +77,22 @@ public class MultipartStream {
    * Note that the buffer must be at least big enough to contain the boundary string, plus 4 characters for CR/LF and double dash, plus at
    * least one byte of data.  Too small a buffer size setting will degrade performance.
    *
-   * @param input         The {@code InputStream} to serve as a data source.
-   * @param boundary      The token used for dividing the stream into {@code encapsulations}.
-   * @param configuration The configuration used to parse the stream.
+   * @param input                  The {@code InputStream} to serve as a data source.
+   * @param boundary               The token used for dividing the stream into {@code encapsulations}.
+   * @param multipartConfiguration The configuration used to parse the stream.
+   * @param multipartFileManager   The file manager used to parse the stream.
    * @throws IllegalArgumentException If the buffer size is too small
    */
-  public MultipartStream(final InputStream input, final byte[] boundary, final MultipartProcessorConfiguration configuration) {
+  public MultipartStream(final InputStream input, final byte[] boundary, final MultipartFileManager multipartFileManager,
+                         final MultipartConfiguration multipartConfiguration) {
     Objects.requireNonNull(input);
     Objects.requireNonNull(boundary);
-    Objects.requireNonNull(configuration);
-    this.configuration = configuration;
-
-    int bufSize = configuration.getMultipartBufferSize();
-    // We prepend CR/LF to the boundary to chop trailing CRLF from body-data tokens.
-    if (bufSize < boundary.length * 2) {
-      throw new IllegalArgumentException("The buffer size specified for the MultipartStream is too small. Must be double the boundary length.");
-    }
-
-    this.input = input;
-    this.buffer = new byte[bufSize];
-    this.boundary = new byte[boundary.length + 4]; // CRLF--<boundary> (then we manually handle CRLF or --)
-    this.boundaryStart = 2; // Initially we start after the CRLF
-    this.boundaryLength = boundary.length + 2; // Initially we only analyze the boundary plus the dashes
-
-    // Set up the full boundary
-    System.arraycopy(ControlBytes.MultipartBoundaryPrefix, 0, this.boundary, 0, 4);
-    System.arraycopy(boundary, 0, this.boundary, 4, boundary.length);
-
-    current = 0;
-    end = 0;
-  }
-
-  /**
-   * Constructs a {@code MultipartStream} with a custom size buffer.
-   * <p>
-   * Note that the buffer must be at least big enough to contain the boundary string, plus 4 characters for CR/LF and double dash, plus at
-   * least one byte of data.  Too small a buffer size setting will degrade performance.
-   *
-   * @param input    The {@code InputStream} to serve as a data source.
-   * @param boundary The token used for dividing the stream into {@code encapsulations}.
-   * @param bufSize  The size of the buffer to be used, in bytes.
-   * @throws IllegalArgumentException If the buffer size is too small
-   */
-  public MultipartStream(final InputStream input, final byte[] boundary, final int bufSize) {
-    if (boundary == null) {
-      throw new IllegalArgumentException("Boundary cannot be null.");
-    }
+    Objects.requireNonNull(multipartFileManager);
+    Objects.requireNonNull(multipartConfiguration);
+    this.multipartFileManager = multipartFileManager;
+    this.multipartConfiguration = multipartConfiguration;
 
+    int bufSize = multipartConfiguration.getMultipartBufferSize();
     // We prepend CR/LF to the boundary to chop trailing CRLF from body-data tokens.
     if (bufSize < boundary.length * 2) {
       throw new IllegalArgumentException("The buffer size specified for the MultipartStream is too small. Must be double the boundary length.");
@@ -133,9 +103,6 @@ public MultipartStream(final InputStream input, final byte[] boundary, final int
     this.boundary = new byte[boundary.length + 4]; // CRLF--<boundary> (then we manually handle CRLF or --)
     this.boundaryStart = 2; // Initially we start after the CRLF
     this.boundaryLength = boundary.length + 2; // Initially we only analyze the boundary plus the dashes
-    // Take the defaults, but enable file uploads
-    this.configuration = new MultipartProcessorConfiguration();
-    this.configuration.setFileUploadEnabled(true);
 
     // Set up the full boundary
     System.arraycopy(ControlBytes.MultipartBoundaryPrefix, 0, this.boundary, 0, 4);
@@ -344,13 +311,13 @@ private void readPart(Map<String, HeaderValue> headers, Map<String, List<String>
 
     PartProcessor processor;
     if (isFile) {
-      // TODO : Daniel : Fail. We could return a 400, but that means we need to try and drain the InputStream which could be very large.
-      //                       But maybe that is ok, this would be a server level configuration, so perhaps this is reasonable to fail hard.
-      if (!configuration.isFileUploadEnabled()) {
-        throw new FileUploadDisabled();
+      if (!multipartConfiguration.isFileUploadEnabled()) {
+        throw new UnprocessableContentException("The multipart stream cannot be processed. Multipart processing of files has been disabled.");
       }
 
-      processor = new FilePartProcessor(contentTypeString, encoding, filename, name, configuration.getMaxFileSize());
+      Path tempDir = Paths.get(multipartConfiguration.getTemporaryFileLocation());
+      Path tempFile = multipartFileManager.createTemporaryFile(tempDir, multipartConfiguration.getTemporaryFilenamePrefix(), multipartConfiguration.getTemporaryFilenameSuffix());
+      processor = new FilePartProcessor(contentTypeString, encoding, filename, name, multipartConfiguration.getMaxFileSize(), tempFile);
     } else {
       processor = new ParameterPartProcessor(encoding);
     }
@@ -405,9 +372,11 @@ private boolean reload(int minimumToLoad) throws IOException {
       int read = input.read(buffer, start, buffer.length - start);
       // Keep track of all bytes read for this multipart stream. Fail if the length has been exceeded.
       bytesRead += read;
-      if (configuration != null) {
-        if (bytesRead > configuration.getMaxRequestSize()) {
-          throw new MultipartRequestTooLarge(configuration.getMaxRequestSize());
+      if (multipartConfiguration != null) {
+        long maximumRequestSize = multipartConfiguration.getMaxRequestSize();
+        if (bytesRead > maximumRequestSize) {
+          String detailedMessage = "The maximum request size of multipart stream has been exceeded. The maximum request size is [" + maximumRequestSize + "] bytes.";
+          throw new ContentTooLarge(maximumRequestSize, detailedMessage);
         }
       }
       end += read;
@@ -449,13 +418,14 @@ private class FilePartProcessor implements PartProcessor {
 
     private long bytesWritten;
 
-    private FilePartProcessor(String contentType, Charset encoding, String filename, String name, long maxFileSize) throws IOException {
+    private FilePartProcessor(String contentType, Charset encoding, String filename, String name, long maxFileSize, Path path)
+        throws IOException {
       this.contentType = contentType;
       this.encoding = encoding;
       this.filename = filename;
       this.name = name;
       this.maxFileSize = maxFileSize;
-      path = Files.createTempFile(Paths.get(configuration.getTemporaryFileLocation()), configuration.getTemporaryFilenamePrefix(), configuration.getTemporaryFilenameSuffix());
+      this.path = path;
       this.output = Files.newOutputStream(this.path);
     }
 
@@ -475,7 +445,8 @@ public void process(int start, int end) throws IOException {
       // TODO : Daniel : Review : We have not kept track of the file we opened here, so we need to either add a file listener, and have someone
       //        else delete the file, we could delete it here, or someone could catch this exception and review all in flight files and then delete?
       if (bytesWritten > maxFileSize) {
-        throw new FileUploadTooLarge(maxFileSize);
+        String detailedMessage = "The maximum size of a single file in a multipart stream has been exceeded. The maximum file size is [" + maxFileSize + "] bytes.";
+        throw new ContentTooLarge(maxFileSize, detailedMessage);
       }
 
       output.write(buffer, start, end - start);
diff --git a/src/main/java/io/fusionauth/http/io/MultipartProcessor.java b/src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java
similarity index 53%
rename from src/main/java/io/fusionauth/http/io/MultipartProcessor.java
rename to src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java
index 0588a4a..52248bd 100644
--- a/src/main/java/io/fusionauth/http/io/MultipartProcessor.java
+++ b/src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java
@@ -19,22 +19,31 @@
 import java.io.InputStream;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 import io.fusionauth.http.FileInfo;
 
 /**
- * An HTTP request processor that can handle a <code>Content-Type: multipart/form-data</code>.
+ * An HTTP input stream processor that can handle a <code>Content-Type: multipart/form-data</code>.
+ * <p>
+ * This implementation is configurable.
+ *
+ * @author Daniel DeGroff
  */
-public class MultipartProcessor {
-  private final MultipartProcessorConfiguration configuration;
+public class MultipartStreamProcessor {
+  private final MultipartConfiguration multipartConfiguration;
+
+  private final MultipartFileManager multipartFileManager;
 
-  public MultipartProcessor(MultipartProcessorConfiguration configuration) {
-    this.configuration = configuration;
+  public MultipartStreamProcessor(MultipartFileManager multipartFileManager, MultipartConfiguration multipartConfiguration) {
+    Objects.requireNonNull(multipartConfiguration);
+    Objects.requireNonNull(multipartFileManager);
+    this.multipartFileManager = multipartFileManager;
+    this.multipartConfiguration = multipartConfiguration;
   }
 
   public void process(final InputStream inputStream, Map<String, List<String>> parameters, List<FileInfo> files, byte[] boundary)
       throws IOException {
-    MultipartStream stream = new MultipartStream(inputStream, boundary, configuration);
-    stream.process(parameters, files);
+    new MultipartStream(inputStream, boundary, multipartFileManager, multipartConfiguration).process(parameters, files);
   }
 }
diff --git a/src/main/java/io/fusionauth/http/server/Configurable.java b/src/main/java/io/fusionauth/http/server/Configurable.java
index 4914052..842bce9 100644
--- a/src/main/java/io/fusionauth/http/server/Configurable.java
+++ b/src/main/java/io/fusionauth/http/server/Configurable.java
@@ -18,7 +18,7 @@
 import java.nio.file.Path;
 import java.time.Duration;
 
-import io.fusionauth.http.io.MultipartProcessorConfiguration;
+import io.fusionauth.http.io.MultipartConfiguration;
 import io.fusionauth.http.log.LoggerFactory;
 import io.fusionauth.http.log.SystemOutLoggerFactory;
 
@@ -195,7 +195,7 @@ default T withMinimumWriteThroughput(long bytesPerSecond) {
    *
    * @param multipartBufferSize The size of the buffer.
    * @return This.
-   * @deprecated use the configuration found in {@link MultipartProcessorConfiguration} instead.
+   * @deprecated use the configuration found in {@link MultipartConfiguration} instead.
    */
   @Deprecated
   default T withMultipartBufferSize(int multipartBufferSize) {
@@ -208,11 +208,11 @@ default T withMultipartBufferSize(int multipartBufferSize) {
    * <p>
    * This configuration is used when parsing a multipart HTTP request that includes files.
    *
-   * @param multipartProcessorConfiguration The configuration.
+   * @param multipartStreamConfiguration The configuration.
    * @return This
    */
-  default T withMultipartConfiguration(MultipartProcessorConfiguration multipartProcessorConfiguration) {
-    configuration().withMultipartConfiguration(multipartProcessorConfiguration);
+  default T withMultipartConfiguration(MultipartConfiguration multipartStreamConfiguration) {
+    configuration().withMultipartConfiguration(multipartStreamConfiguration);
     return (T) this;
   }
 
diff --git a/src/main/java/io/fusionauth/http/server/HTTP11Processor.java b/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
index d2ac029..d5dda2b 100644
--- a/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
+++ b/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022-2023, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,8 +20,12 @@
 import java.nio.channels.SelectionKey;
 import java.util.concurrent.Future;
 
+import io.fusionauth.http.HTTPProcessingException;
 import io.fusionauth.http.io.BlockingByteBufferOutputStream;
-import io.fusionauth.http.io.MultipartProcessor;
+import io.fusionauth.http.io.MultipartStreamProcessor;
+import io.fusionauth.http.io.DefaultMultipartFileManager;
+import io.fusionauth.http.io.MultipartFileManager;
+import io.fusionauth.http.io.MultipartConfiguration;
 import io.fusionauth.http.log.Logger;
 import io.fusionauth.http.util.ThreadPool;
 
@@ -35,6 +39,8 @@ public class HTTP11Processor implements HTTPProcessor {
 
   private final Logger logger;
 
+  private final MultipartFileManager multipartFileManager;
+
   private final Notifier notifier;
 
   private final ByteBuffer preambleBuffer;
@@ -74,8 +80,14 @@ public HTTP11Processor(HTTPServerConfiguration configuration, HTTPListenerConfig
     this.threadPool = threadPool;
     this.state = ProcessorState.Read;
 
+    // Note that it is important to deep copy the configuration. The HTTP request handler may wish to modify these defaults.
+    // - This needs to be a 'request' scoped configuration.
+    MultipartConfiguration multipartStreamConfiguration = new MultipartConfiguration(configuration.getMultipartStreamConfiguration());
+
+    this.multipartFileManager = new DefaultMultipartFileManager();
     this.request = new HTTPRequest(configuration.getContextPath(), listener.isTLS() ? "https" : "http", listener.getPort(), ipAddress);
-    this.request.setMultiPartProcessor(new MultipartProcessor(configuration.getMultipartProcessorConfiguration()));
+
+    this.request.setMultiPartStreamProcessor(new MultipartStreamProcessor(multipartFileManager, multipartStreamConfiguration));
     this.requestProcessor = new HTTPRequestProcessor(configuration, request);
 
     BlockingByteBufferOutputStream outputStream = new BlockingByteBufferOutputStream(notifier, configuration.getResponseBufferSize(), configuration.getMaxOutputBufferQueueLength());
@@ -108,7 +120,17 @@ public void failure(Throwable t) {
     } else {
       // Maintain the `write` state but reset to Preamble to write the new headers
       state = ProcessorState.Write;
-      responseProcessor.failure();
+      responseProcessor.failure(response -> {
+        if (t instanceof HTTPProcessingException hpe) {
+          response.setStatus(hpe.getStatus());
+          String statusMessage = hpe.getStatusMessage();
+          if (statusMessage != null) {
+            response.setStatusMessage(statusMessage);
+          }
+        }
+      });
+
+      logger.debug("Processing failed. Return status [" + response.getStatus() + "] Cause [" + t.getClass().getSimpleName() + "] Message: " + t.getMessage());
     }
 
     notifier.notifyNow();
@@ -159,7 +181,7 @@ public ProcessorState read(ByteBuffer buffer) throws IOException {
       // If the next state is not preamble, that means we are done processing that and ready to handle the request in a separate thread
       if (requestState != RequestState.Preamble && requestState != RequestState.Expect) {
         logger.trace("(RWo)");
-        future = threadPool.submit(new HTTPWorker(configuration.getHandler(), configuration.getLoggerFactory(), this, request, response));
+        future = threadPool.submit(new HTTPWorker(configuration, configuration.getHandler(), multipartFileManager, configuration.getLoggerFactory(), this, request, response));
       }
     } else {
       logger.trace("(RB)");
@@ -279,7 +301,7 @@ public ProcessorState wrote(long num) {
       // Flip back to reading and back to the preamble state, so we write the real response headers. Then start the worker thread and flip the ops
       requestProcessor.resetState(RequestState.Body);
       responseProcessor.resetState(ResponseState.Preamble);
-      future = threadPool.submit(new HTTPWorker(configuration.getHandler(), configuration.getLoggerFactory(), this, request, response));
+      future = threadPool.submit(new HTTPWorker(configuration, configuration.getHandler(), multipartFileManager, configuration.getLoggerFactory(), this, request, response));
       state = ProcessorState.Read;
     } else if (responseState == ResponseState.KeepAlive) {
       logger.trace("(WKA)");
diff --git a/src/main/java/io/fusionauth/http/server/HTTPRequest.java b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
index f98ed96..b2dd318 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPRequest.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
@@ -45,9 +45,9 @@
 import io.fusionauth.http.HTTPValues.ContentTypes;
 import io.fusionauth.http.HTTPValues.Headers;
 import io.fusionauth.http.HTTPValues.TransferEncodings;
+import io.fusionauth.http.UnprocessableContentException;
 import io.fusionauth.http.body.BodyException;
-import io.fusionauth.http.io.MultipartProcessor;
-import io.fusionauth.http.io.MultipartStream;
+import io.fusionauth.http.io.MultipartStreamProcessor;
 import io.fusionauth.http.util.HTTPTools;
 import io.fusionauth.http.util.HTTPTools.HeaderValue;
 import io.fusionauth.http.util.WeightedString;
@@ -75,9 +75,6 @@ public class HTTPRequest implements Buildable<HTTPRequest> {
 
   private final List<Locale> locales = new LinkedList<>();
 
-  // Note this is only used when a multipart processor is not provided.
-  private final int multipartBufferSize;
-
   private final Map<String, List<String>> urlParameters = new HashMap<>();
 
   private byte[] bodyBytes;
@@ -106,7 +103,7 @@ public class HTTPRequest implements Buildable<HTTPRequest> {
 
   private String multipartBoundary;
 
-  private MultipartProcessor multipartProcessor;
+  private MultipartStreamProcessor multipartStreamProcess;
 
   private String path = "/";
 
@@ -120,14 +117,12 @@ public class HTTPRequest implements Buildable<HTTPRequest> {
 
   public HTTPRequest() {
     this.contextPath = "";
-    this.multipartBufferSize = 1024;
   }
 
-  public HTTPRequest(String contextPath, @Deprecated int multipartBufferSize, String scheme, int port, String ipAddress) {
+  public HTTPRequest(String contextPath, int multipartBufferSize, String scheme, int port, String ipAddress) {
     Objects.requireNonNull(contextPath);
     Objects.requireNonNull(scheme);
     this.contextPath = contextPath;
-    this.multipartBufferSize = multipartBufferSize;
     this.scheme = scheme;
     this.port = port;
     this.ipAddress = ipAddress;
@@ -137,7 +132,6 @@ public HTTPRequest(String contextPath, String scheme, int port, String ipAddress
     Objects.requireNonNull(contextPath);
     Objects.requireNonNull(scheme);
     this.contextPath = contextPath;
-    this.multipartBufferSize = 1024;
     this.scheme = scheme;
     this.port = port;
     this.ipAddress = ipAddress;
@@ -366,15 +360,12 @@ public Map<String, List<String>> getFormData() {
         byte[] body = getBodyBytes();
         HTTPTools.parseEncodedData(body, 0, body.length, formData);
       } else if (isMultipart()) {
+        if (multipartStreamProcess == null) {
+          throw new UnprocessableContentException("The multipart stream cannot be processed. A multipart processing has not been provided.");
+        }
+
         try {
-          if (multipartProcessor != null) {
-            multipartProcessor.process(inputStream, formData, files, multipartBoundary.getBytes());
-          } else {
-            // A multipart processor has not been set. The request will be parsed and processed without any configuration.
-            // TODO : Daniel : Review : We may want to just yank this code and either no-op or fail if a processor is not set.
-            MultipartStream stream = new MultipartStream(inputStream, multipartBoundary.getBytes(), multipartBufferSize);
-            stream.process(formData, files);
-          }
+          multipartStreamProcess.process(inputStream, formData, files, multipartBoundary.getBytes());
         } catch (IOException e) {
           throw new BodyException("Invalid multipart body.", e);
         }
@@ -678,8 +669,8 @@ public void setHeaders(String name, Collection<String> values) {
     }
   }
 
-  public void setMultiPartProcessor(MultipartProcessor multipartProcessor) {
-    this.multipartProcessor = multipartProcessor;
+  public void setMultiPartStreamProcessor(MultipartStreamProcessor multipartProcessor) {
+    this.multipartStreamProcess = multipartProcessor;
   }
 
   public void setURLParameter(String name, String value) {
diff --git a/src/main/java/io/fusionauth/http/server/HTTPResponseProcessor.java b/src/main/java/io/fusionauth/http/server/HTTPResponseProcessor.java
index 2c8288d..ba7c999 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPResponseProcessor.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPResponseProcessor.java
@@ -16,6 +16,7 @@
 package io.fusionauth.http.server;
 
 import java.nio.ByteBuffer;
+import java.util.function.Consumer;
 
 import io.fusionauth.http.Cookie;
 import io.fusionauth.http.HTTPValues.Connections;
@@ -143,7 +144,7 @@ public synchronized ByteBuffer[] currentBuffer() {
     return null;
   }
 
-  public synchronized void failure() {
+  public synchronized void failure(Consumer<HTTPResponse> consumer) {
     // Go nuclear and wipe the response and stream, even if the response has already been committed (meaning one or more bytes have been
     // written)
     response.setStatus(500);
@@ -153,6 +154,10 @@ public synchronized void failure() {
 
     preambleBuffers = null;
 
+    if (consumer != null) {
+      consumer.accept(response);
+    }
+
     outputStream.clear();
     outputStream.close();
     state = ResponseState.Preamble;
diff --git a/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java b/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
index 3a63962..cddc1e0 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
@@ -21,7 +21,7 @@
 import java.util.List;
 import java.util.Objects;
 
-import io.fusionauth.http.io.MultipartProcessorConfiguration;
+import io.fusionauth.http.io.MultipartConfiguration;
 import io.fusionauth.http.log.LoggerFactory;
 import io.fusionauth.http.log.SystemOutLoggerFactory;
 
@@ -59,7 +59,7 @@ public class HTTPServerConfiguration implements Configurable<HTTPServerConfigura
 
   private int multipartBufferSize = 16 * 1024;
 
-  private MultipartProcessorConfiguration multipartProcessorConfiguration;
+  private MultipartConfiguration multipartStreamConfiguration = new MultipartConfiguration();
 
   private int numberOfWorkerThreads = 40;
 
@@ -151,18 +151,17 @@ public long getMinimumWriteThroughput() {
     return minimumWriteThroughput;
   }
 
-  // Use the configuration found in the MultipartProcessorConfiguration instead.
+  // Use the configuration found in the MultipartStreamConfiguration instead.
   @Deprecated
   public int getMultipartBufferSize() {
     return multipartBufferSize;
   }
 
   /**
-   *
    * @return the multipart processor configuration.
    */
-  public MultipartProcessorConfiguration getMultipartProcessorConfiguration() {
-    return multipartProcessorConfiguration;
+  public MultipartConfiguration getMultipartStreamConfiguration() {
+    return multipartStreamConfiguration;
   }
 
   /**
@@ -382,10 +381,10 @@ public HTTPServerConfiguration withMultipartBufferSize(int multipartBufferSize)
   }
 
   @Override
-  public HTTPServerConfiguration withMultipartConfiguration(MultipartProcessorConfiguration multipartProcessorConfiguration) {
-    Objects.requireNonNull(multipartProcessorConfiguration, "You cannot set the multipart processor configuration to null");
+  public HTTPServerConfiguration withMultipartConfiguration(MultipartConfiguration multipartStreamConfiguration) {
+    Objects.requireNonNull(multipartStreamConfiguration, "You cannot set the multipart stream configuration to null");
 
-    this.multipartProcessorConfiguration = multipartProcessorConfiguration;
+    this.multipartStreamConfiguration = multipartStreamConfiguration;
     return this;
   }
 
diff --git a/src/main/java/io/fusionauth/http/server/HTTPWorker.java b/src/main/java/io/fusionauth/http/server/HTTPWorker.java
index 23593b1..6776c54 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPWorker.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPWorker.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,6 +15,9 @@
  */
 package io.fusionauth.http.server;
 
+import java.nio.file.Files;
+
+import io.fusionauth.http.io.MultipartFileManager;
 import io.fusionauth.http.log.Logger;
 import io.fusionauth.http.log.LoggerFactory;
 import io.fusionauth.http.util.ThreadPool;
@@ -26,17 +29,24 @@
  * @author Brian Pontarelli
  */
 public class HTTPWorker implements Runnable {
+  private final HTTPServerConfiguration configuration;
+
   private final HTTPHandler handler;
 
   private final Logger logger;
 
+  private final MultipartFileManager multipartFileManager;
+
   private final HTTPProcessor processor;
 
   private final HTTPRequest request;
 
   private final HTTPResponse response;
 
-  public HTTPWorker(HTTPHandler handler, LoggerFactory loggerFactory, HTTPProcessor processor, HTTPRequest request, HTTPResponse response) {
+  public HTTPWorker(HTTPServerConfiguration configuration, HTTPHandler handler, MultipartFileManager multipartFileManager,
+                    LoggerFactory loggerFactory, HTTPProcessor processor, HTTPRequest request, HTTPResponse response) {
+    this.configuration = configuration;
+    this.multipartFileManager = multipartFileManager;
     this.handler = handler;
     this.logger = loggerFactory.getLogger(HTTPWorker.class);
     this.processor = processor;
@@ -55,6 +65,18 @@ public void run() {
       // Log the error and signal a failure
       logger.error("HTTP worker threw an exception while processing a request", t);
       processor.failure(t);
+    } finally {
+      // Clean up temporary files if instructed to do so.
+      if (configuration.getMultipartStreamConfiguration().deleteTemporaryFiles()) {
+        for (var file : multipartFileManager.getTemporaryFiles()) {
+          try {
+            logger.debug("Delete temporary file [{}]", file);
+            Files.deleteIfExists(file);
+          } catch (Exception e) {
+            logger.error("Unable to delete temporary file. [" + file + "]", e);
+          }
+        }
+      }
     }
   }
 }
diff --git a/src/test/java/io/fusionauth/http/BaseTest.java b/src/test/java/io/fusionauth/http/BaseTest.java
index 6913f74..d3c21b0 100644
--- a/src/test/java/io/fusionauth/http/BaseTest.java
+++ b/src/test/java/io/fusionauth/http/BaseTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022-2024, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -95,7 +95,7 @@ public abstract class BaseTest {
    * This timeout is used for the HttpClient during each test. If you are in a debugger, you will need to change this timeout to be much
    * larger, otherwise, the client might truncate the request to the server.
    */
-  public static final Duration ClientTimeout = Duration.ofSeconds(2);
+  public static final Duration ClientTimeout = Duration.ofSeconds(5);
 
   /**
    * This timeout is used for the HTTPServer during each test. If you are in a debugger, you will need to change this timeout to be much
diff --git a/src/test/java/io/fusionauth/http/MultipartTest.java b/src/test/java/io/fusionauth/http/MultipartTest.java
index 3bcec93..6dca128 100644
--- a/src/test/java/io/fusionauth/http/MultipartTest.java
+++ b/src/test/java/io/fusionauth/http/MultipartTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,13 +20,17 @@
 import java.net.URI;
 import java.net.http.HttpRequest;
 import java.net.http.HttpRequest.BodyPublishers;
+import java.net.http.HttpResponse;
 import java.net.http.HttpResponse.BodySubscribers;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
+import java.time.Duration;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Consumer;
 
 import io.fusionauth.http.HTTPValues.Headers;
+import io.fusionauth.http.io.MultipartConfiguration;
 import io.fusionauth.http.server.CountingInstrumenter;
 import io.fusionauth.http.server.HTTPHandler;
 import io.fusionauth.http.server.HTTPServer;
@@ -86,9 +90,12 @@ public void post(String scheme) throws Exception {
     };
 
     CountingInstrumenter instrumenter = new CountingInstrumenter();
-    try (HTTPServer ignore = makeServer(scheme, handler, instrumenter).start()) {
+    try (HTTPServer ignore = makeServer(scheme, handler, instrumenter)
+        .withMultipartConfiguration(new MultipartConfiguration().withFileUploadEnabled(true))
+        .start()) {
       URI uri = makeURI(scheme, "");
       var client = makeClient(scheme, null);
+      System.out.println("make client...");
       var response = client.send(
           HttpRequest.newBuilder()
                      .uri(uri)
@@ -96,9 +103,168 @@ public void post(String scheme) throws Exception {
                      .POST(BodyPublishers.ofString(Body)).build(),
           r -> BodySubscribers.ofString(StandardCharsets.UTF_8)
       );
+      System.out.println("assert response from client...");
 
       assertEquals(response.statusCode(), 200);
       assertEquals(response.body(), ExpectedResponse);
     }
   }
+
+  @Test(dataProvider = "schemes")
+  public void post_server_configuration_fileTooBig(String scheme) throws Exception {
+    // File too big even though the overall request size is ok.
+    withScheme(scheme)
+        .withFileSize(513) // 513 bytes
+        .withConfiguration(new MultipartConfiguration().withFileUploadEnabled(true)
+                                                       // Max file size is 2Mb
+                                                       .withMaxFileSize(512)
+                                                       // Max request size is 10 Mb
+                                                       .withMaxRequestSize(10 * 1024 * 1024))
+        .expect(response -> assertEquals(response.statusCode(), 413));
+  }
+
+  @Test(dataProvider = "schemes")
+  public void post_server_configuration_file_upload_disabled(String scheme) throws Exception {
+    // File uploads disabled
+    withScheme(scheme)
+        .withConfiguration(new MultipartConfiguration().withFileUploadEnabled(false))
+        .expect(response -> assertEquals(response.statusCode(), 422));
+  }
+
+  @Test(dataProvider = "schemes")
+  public void post_server_configuration_requestTooBig(String scheme) throws Exception {
+    // Request too big
+    withScheme(scheme)
+        .withFileSize(512)   // 512 bytes
+        .withFileCount(5)    // 5 files, for a total of 2,560 bytes in the request
+        .withConfiguration(new MultipartConfiguration().withFileUploadEnabled(true)
+                                                       // Max file size is 1024 bytes, our files will be 512
+                                                       .withMaxFileSize(1024)
+                                                       // Max request size is 2048 bytes
+                                                       .withMaxRequestSize(2048))
+        .expect(response -> assertEquals(response.statusCode(), 413));
+  }
+
+  private Builder withConfiguration(MultipartConfiguration configuration) throws Exception {
+    return new Builder("http").withConfiguration(configuration);
+  }
+
+  private Builder withScheme(String scheme) throws Exception {
+    return new Builder(scheme);
+  }
+
+  private class Builder {
+    private MultipartConfiguration configuration;
+
+    private int fileCount = 1;
+
+    private int fileSize = 42;
+
+    private String scheme;
+
+    public Builder(String scheme) {
+      this.scheme = scheme;
+    }
+
+    public void expect(Consumer<HttpResponse<String>> consumer) throws Exception {
+      HTTPHandler handler = (req, res) -> {
+        System.out.println("Handling");
+        assertEquals(req.getContentType(), "multipart/form-data");
+
+        Map<String, List<String>> form = req.getFormData();
+        assertEquals(form.get("foo"), List.of("bar"));
+
+        List<FileInfo> files = req.getFiles();
+        assertEquals(files.get(0).getContentType(), "text/plain");
+        assertEquals(files.get(0).getEncoding(), StandardCharsets.ISO_8859_1);
+        assertEquals(files.get(0).getName(), "file");
+        assertEquals(Files.readString(files.get(0).getFile()), "filecontents");
+
+        Files.delete(files.get(0).getFile());
+
+        System.out.println("Done");
+        res.setHeader(Headers.ContentType, "text/plain");
+        res.setHeader("Content-Length", "16");
+        res.setStatus(200);
+
+        try {
+          System.out.println("Writing");
+          OutputStream outputStream = res.getOutputStream();
+          outputStream.write(ExpectedResponse.getBytes());
+          outputStream.close();
+        } catch (IOException e) {
+          throw new RuntimeException(e);
+        }
+      };
+
+      // Server level configuration : File uploads are disabled
+      try (HTTPServer ignore = makeServer(scheme, handler, null)
+          .withClientTimeout(Duration.ofSeconds(30))
+          .withMinimumWriteThroughput(1024)
+          .withMinimumReadThroughput(1024)
+          .withMultipartConfiguration(configuration)
+          .start()) {
+
+        // Build the request body per the builder specs.
+        String boundary = "------WebKitFormBoundaryTWfMVJErBoLURJIe";
+        String body = boundary +
+            """
+                \r
+                Content-Disposition: form-data; name="foo"\r
+                \r
+                bar\r
+                """;
+
+        String file = "X".repeat(fileSize);
+        // Append files to the request body
+        for (int i = 0; i < fileCount; i++) {
+          body += boundary;
+          body += """
+              \r
+              Content-Disposition: form-data; name="file"; filename="foo.jpg"\r
+              Content-Type: text/plain; charset=ISO8859-1\r
+              \r
+              {file}\r
+              """.replace("{file}", file);
+        }
+
+        body += boundary + "--";
+
+
+        var uri = makeURI(scheme, "");
+        var client = makeClient(scheme, null);
+        // File uploads are disabled.
+        var response = client.send(
+            HttpRequest.newBuilder()
+                       .uri(uri)
+                       .timeout(Duration.ofSeconds(30))
+                       .header(Headers.ContentType, "multipart/form-data; boundary=----WebKitFormBoundaryTWfMVJErBoLURJIe")
+                       .POST(BodyPublishers.ofString(body)).build(),
+            r -> BodySubscribers.ofString(StandardCharsets.UTF_8));
+
+        consumer.accept(response);
+      }
+    }
+
+    public Builder withConfiguration(MultipartConfiguration configuration) throws Exception {
+      this.configuration = configuration;
+      return this;
+    }
+
+    public Builder withFileCount(int fileCount) {
+      this.fileCount = fileCount;
+      return this;
+    }
+
+    public Builder withFileSize(int fileSize) {
+      this.fileSize = fileSize;
+      return this;
+    }
+
+    public void withScheme(String scheme) {
+      this.scheme = scheme;
+    }
+  }
+
+
 }
diff --git a/src/test/java/io/fusionauth/http/io/MultipartStreamTest.java b/src/test/java/io/fusionauth/http/io/MultipartStreamTest.java
index 282dc70..7b9048c 100644
--- a/src/test/java/io/fusionauth/http/io/MultipartStreamTest.java
+++ b/src/test/java/io/fusionauth/http/io/MultipartStreamTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022-2023, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,6 +26,8 @@
 
 import io.fusionauth.http.FileInfo;
 import io.fusionauth.http.ParseException;
+import org.testng.annotations.AfterTest;
+import org.testng.annotations.BeforeTest;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 import static org.testng.Assert.assertEquals;
@@ -34,6 +36,19 @@
  * @author Brian Pontarelli
  */
 public class MultipartStreamTest {
+  private MultipartFileManager fileManager;
+
+  @AfterTest
+  public void afterTest() {
+    for (var file : fileManager.getTemporaryFiles()) {
+      try {
+        Files.deleteIfExists(file);
+      } catch (Exception e) {
+        throw new RuntimeException(e);
+      }
+    }
+  }
+
   @DataProvider(name = "badBoundary")
   public Object[][] badBoundary() {
     return new Object[][]{
@@ -52,10 +67,15 @@ public Object[][] badBoundary() {
 
   @Test(dataProvider = "badBoundary", expectedExceptions = ParseException.class, expectedExceptionsMessageRegExp = "Invalid multipart body. Ran out of data while processing.")
   public void bad_boundaryParameter(String boundary) throws IOException {
-    new MultipartStream(new ByteArrayInputStream(boundary.getBytes()), "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024)
+    new MultipartStream(new ByteArrayInputStream(boundary.getBytes()), "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true))
         .process(new HashMap<>(), new LinkedList<>());
   }
 
+  @BeforeTest
+  public void beforeTest() {
+    fileManager = new DefaultMultipartFileManager();
+  }
+
   @Test
   public void boundaryInParameter() throws IOException {
     ByteArrayInputStream is = new ByteArrayInputStream("""
@@ -66,7 +86,7 @@ public void boundaryInParameter() throws IOException {
         ------WebKitFormBoundaryTWfMVJErBoLURJIe--""".getBytes());
     Map<String, List<String>> parameters = new HashMap<>();
     List<FileInfo> files = new LinkedList<>();
-    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024);
+    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true));
     stream.process(parameters, files);
 
     assertEquals(parameters.get("foo"), List.of("bar------WebKitFormBoundaryTWfMVJErBoLURJIe"));
@@ -82,7 +102,7 @@ public void file() throws IOException {
         ------WebKitFormBoundaryTWfMVJErBoLURJIe--""".getBytes());
     Map<String, List<String>> parameters = new HashMap<>();
     List<FileInfo> files = new LinkedList<>();
-    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024);
+    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true));
     stream.process(parameters, files);
 
     assertEquals(files.size(), 1);
@@ -108,7 +128,7 @@ public void mixed() throws IOException {
         ------WebKitFormBoundaryTWfMVJErBoLURJIe--""".getBytes());
     Map<String, List<String>> parameters = new HashMap<>();
     List<FileInfo> files = new LinkedList<>();
-    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024);
+    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true));
     stream.process(parameters, files);
 
     assertEquals(parameters.get("foo"), List.of("bar"));
@@ -132,7 +152,7 @@ public void parameter() throws IOException {
         ------WebKitFormBoundaryTWfMVJErBoLURJIe--""".getBytes());
     Map<String, List<String>> parameters = new HashMap<>();
     List<FileInfo> files = new LinkedList<>();
-    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024);
+    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true));
     stream.process(parameters, files);
 
     assertEquals(parameters.get("foo"), List.of("bar"));
@@ -148,7 +168,7 @@ public void partialBoundaryInParameter() throws IOException {
         ------WebKitFormBoundaryTWfMVJErBoLURJIe--""".getBytes());
     Map<String, List<String>> parameters = new HashMap<>();
     List<FileInfo> files = new LinkedList<>();
-    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024);
+    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true));
     stream.process(parameters, files);
 
     assertEquals(parameters.get("foo"), List.of("------WebKitFormBoundaryTWfMVJErBoLURJI"));
@@ -178,7 +198,7 @@ public void separateParts(@SuppressWarnings("unused") int index, byte[][] parts)
     PartInputStream is = new PartInputStream(parts);
     Map<String, List<String>> parameters = new HashMap<>();
     List<FileInfo> files = new LinkedList<>();
-    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), 1024);
+    MultipartStream stream = new MultipartStream(is, "----WebKitFormBoundaryTWfMVJErBoLURJIe".getBytes(), fileManager, new MultipartConfiguration().withFileUploadEnabled(true));
     stream.process(parameters, files);
 
     assertEquals(parameters.get("foo"), List.of("bar"));

From 9fdfa5ba4bd43c5db7743c74584a2a126f4b2899 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Tue, 10 Jun 2025 18:53:41 -0600
Subject: [PATCH 4/5] Working

---
 design/file-upload.md | 64 -------------------------------------------
 1 file changed, 64 deletions(-)
 delete mode 100644 design/file-upload.md

diff --git a/design/file-upload.md b/design/file-upload.md
deleted file mode 100644
index 261197d..0000000
--- a/design/file-upload.md
+++ /dev/null
@@ -1,64 +0,0 @@
-### File Upload
-
-
-
-### Use Cases
-1. Restrict file uploads  
-   - In a multi 
-2. Allow uploads all the time
-3. Allow uploads, mvc Action dependant
-4. Allow uploads, mvc Action dependant, delete on action completion.
-   - This means the action is responsible to:
-      - Move the file
-      - Tell us not to delete it
-
-
-
-### Examples
-
-### Spring Boot
-
-- https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/MultipartProperties.java
-
-`MultipartProperties.java`
-```java
-/**
- * Whether to enable support of multipart uploads.
- */
-private boolean enabled = true;
-
-/**
- * Intermediate location of uploaded files.
- */
-private String location;
-
-/**
- * Max file size.
- */
-private DataSize maxFileSize = DataSize.ofMegabytes(1);
-
-/**
- * Max request size.
- */
-private DataSize maxRequestSize = DataSize.ofMegabytes(10);
-
-/**
- * Threshold after which files are written to disk.
- */
-private DataSize fileSizeThreshold = DataSize.ofBytes(0);
-
-/**
- * Whether to resolve the multipart request lazily at the time of file or parameter
- * access.
- */
-private boolean resolveLazily = false;
-```
-
-
-#### Summary
-- Accept Multi-Part
-- See ContentDisposition with a file, collect meta-data about the file, do not create a file yet.
-- Uses Servlet handling and "parses" the request if not set to lazily. This functionally does what we are doing, it writes all the files to disk.
-
-
-io.undertow.server.handlers.form.FormDataParser - has a `close()` method and deletes all files on close. 

From 9cda465a331cbd37ae4b7510b484633f6415c8da Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 11 Jun 2025 18:14:06 -0600
Subject: [PATCH 5/5] working

---
 build.savant                                          |  2 +-
 .../fusionauth/http/io/MultipartStreamProcessor.java  |  9 ++++++++-
 .../io/fusionauth/http/server/HTTP11Processor.java    | 11 ++++-------
 .../java/io/fusionauth/http/server/HTTPRequest.java   |  5 +++++
 .../http/server/HTTPServerConfiguration.java          |  5 ++---
 .../java/io/fusionauth/http/server/HTTPWorker.java    |  2 +-
 6 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/build.savant b/build.savant
index 78c8214..95bb0fa 100644
--- a/build.savant
+++ b/build.savant
@@ -17,7 +17,7 @@ jackson5Version = "3.0.1"
 restifyVersion = "4.2.1"
 testngVersion = "7.10.2"
 
-project(group: "io.fusionauth", name: "java-http", version: "0.3.6", licenses: ["ApacheV2_0"]) {
+project(group: "io.fusionauth", name: "java-http", version: "0.3.7", licenses: ["ApacheV2_0"]) {
   workflow {
     fetch {
       // Dependency resolution order:
diff --git a/src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java b/src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java
index 52248bd..d433353 100644
--- a/src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java
+++ b/src/main/java/io/fusionauth/http/io/MultipartStreamProcessor.java
@@ -42,7 +42,14 @@ public MultipartStreamProcessor(MultipartFileManager multipartFileManager, Multi
     this.multipartConfiguration = multipartConfiguration;
   }
 
-  public void process(final InputStream inputStream, Map<String, List<String>> parameters, List<FileInfo> files, byte[] boundary)
+  /**
+   * @return the multipart configuration that will be used for this processor.
+   */
+  public MultipartConfiguration getMultiPartConfiguration() {
+    return multipartConfiguration;
+  }
+
+  public void process(InputStream inputStream, Map<String, List<String>> parameters, List<FileInfo> files, byte[] boundary)
       throws IOException {
     new MultipartStream(inputStream, boundary, multipartFileManager, multipartConfiguration).process(parameters, files);
   }
diff --git a/src/main/java/io/fusionauth/http/server/HTTP11Processor.java b/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
index d5dda2b..1cb6109 100644
--- a/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
+++ b/src/main/java/io/fusionauth/http/server/HTTP11Processor.java
@@ -22,10 +22,10 @@
 
 import io.fusionauth.http.HTTPProcessingException;
 import io.fusionauth.http.io.BlockingByteBufferOutputStream;
-import io.fusionauth.http.io.MultipartStreamProcessor;
 import io.fusionauth.http.io.DefaultMultipartFileManager;
-import io.fusionauth.http.io.MultipartFileManager;
 import io.fusionauth.http.io.MultipartConfiguration;
+import io.fusionauth.http.io.MultipartFileManager;
+import io.fusionauth.http.io.MultipartStreamProcessor;
 import io.fusionauth.http.log.Logger;
 import io.fusionauth.http.util.ThreadPool;
 
@@ -80,14 +80,11 @@ public HTTP11Processor(HTTPServerConfiguration configuration, HTTPListenerConfig
     this.threadPool = threadPool;
     this.state = ProcessorState.Read;
 
-    // Note that it is important to deep copy the configuration. The HTTP request handler may wish to modify these defaults.
-    // - This needs to be a 'request' scoped configuration.
-    MultipartConfiguration multipartStreamConfiguration = new MultipartConfiguration(configuration.getMultipartStreamConfiguration());
-
     this.multipartFileManager = new DefaultMultipartFileManager();
     this.request = new HTTPRequest(configuration.getContextPath(), listener.isTLS() ? "https" : "http", listener.getPort(), ipAddress);
 
-    this.request.setMultiPartStreamProcessor(new MultipartStreamProcessor(multipartFileManager, multipartStreamConfiguration));
+    // Create a deep copy of the MultipartConfiguration so that the request may optionally modify the configuration on a per-request basis.
+    this.request.setMultiPartStreamProcessor(new MultipartStreamProcessor(multipartFileManager, new MultipartConfiguration(configuration.getMultipartConfiguration())));
     this.requestProcessor = new HTTPRequestProcessor(configuration, request);
 
     BlockingByteBufferOutputStream outputStream = new BlockingByteBufferOutputStream(notifier, configuration.getResponseBufferSize(), configuration.getMaxOutputBufferQueueLength());
diff --git a/src/main/java/io/fusionauth/http/server/HTTPRequest.java b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
index b2dd318..83a6335 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPRequest.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPRequest.java
@@ -47,6 +47,7 @@
 import io.fusionauth.http.HTTPValues.TransferEncodings;
 import io.fusionauth.http.UnprocessableContentException;
 import io.fusionauth.http.body.BodyException;
+import io.fusionauth.http.io.MultipartConfiguration;
 import io.fusionauth.http.io.MultipartStreamProcessor;
 import io.fusionauth.http.util.HTTPTools;
 import io.fusionauth.http.util.HTTPTools.HeaderValue;
@@ -464,6 +465,10 @@ public String getMultipartBoundary() {
     return multipartBoundary;
   }
 
+  public MultipartConfiguration getMultipartConfiguration() {
+    return multipartStreamProcess != null ? multipartStreamProcess.getMultiPartConfiguration() : null;
+  }
+
   /**
    * Calls {@link #getParameters()} to combine everything and then returns the first parameter value for the given name.
    *
diff --git a/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java b/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
index cddc1e0..36abdba 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPServerConfiguration.java
@@ -158,9 +158,9 @@ public int getMultipartBufferSize() {
   }
 
   /**
-   * @return the multipart processor configuration.
+   * @return the multipart configuration.
    */
-  public MultipartConfiguration getMultipartStreamConfiguration() {
+  public MultipartConfiguration getMultipartConfiguration() {
     return multipartStreamConfiguration;
   }
 
@@ -237,7 +237,6 @@ public HTTPServerConfiguration withClientTimeout(Duration duration) {
       throw new IllegalArgumentException("The client timeout duration must be greater than 0");
     }
 
-
     this.clientTimeoutDuration = duration;
     return this;
   }
diff --git a/src/main/java/io/fusionauth/http/server/HTTPWorker.java b/src/main/java/io/fusionauth/http/server/HTTPWorker.java
index 6776c54..830efc9 100644
--- a/src/main/java/io/fusionauth/http/server/HTTPWorker.java
+++ b/src/main/java/io/fusionauth/http/server/HTTPWorker.java
@@ -67,7 +67,7 @@ public void run() {
       processor.failure(t);
     } finally {
       // Clean up temporary files if instructed to do so.
-      if (configuration.getMultipartStreamConfiguration().deleteTemporaryFiles()) {
+      if (configuration.getMultipartConfiguration().deleteTemporaryFiles()) {
         for (var file : multipartFileManager.getTemporaryFiles()) {
           try {
             logger.debug("Delete temporary file [{}]", file);