Dealing with Local Files Using the File API

Abstract

It’s a well-known fact that for the sake of security and privacy, browsers don’t allow web applications to tamper with the local file system. Local files are used in a web application only when the user decides to upload them to the server using the HTML <input> element of type file. The title of this chapter may surprise you at first, because the term File API gives the impression of being a full-blown file-system manipulation object model like the System.IO namespace of .NET Framework. Obviously, the people behind HTML5 are aware of the security issues such an object model can create. So, the File API is essentially a cut-down version of a file-handling system in which files can only be read and can’t be modified or deleted. Additionally, the File API can’t read any random file on the machine. File(s) to be read must be explicitly supplied by the user. Thus, the File API is a safe way to read and optionally upload local files with user consent.