We will discuss here what is boundary in multipart/form-data. The boundary is included to separate name/value pair in the multipart/form-data. The boundary parameter acts like a marker for each pair of name and value. The boundary parameter is automatically added to the Content-Type in the request header.

Where does name/value pair come from?

The name and value pair correspond to the name and value respectively of the input field in HTML form we define in our website page.

The name/value pair is passed when we submit the HTML form data and the Content-Type with boundary parameter gets added automatically.

Is arbitrary value allowed in boundary?

Yes, an arbitrary value is allowed in boundary parameter. Make sure that the value for the boundary parameter does not exceed 70 bytes in length and consists only of 7-bit US-ASCII characters.

Is boundary parameter mandatory in multipart/form-data?

Yes, not only in multipart/form-data but also in any of the multipart/* content type.

If you do not specify the boundary parameter then server will not be able to parse the payload.

Is other charset than US-ASCII allowed?

Yes, you can set the charset parameter, for example, to UTF-8 in Content-Type header unless you are absolutely sure that only US-ASCII charset, which is a default value in the absence of charset parameter, will be used in payload.

Boundary delimiter

The RFC2046 says, the Content-Type field for multipart entities requires one parameter – boundary.

The boundary delimiter line is then defined as a line consisting entirely of two hyphen characters (“-“, decimal value 45) followed by the boundary parameter value from the Content-Type header field, optional linear whitespace, and a terminating CRLF.

Boundary delimiters must not appear within the encapsulated material, and must be no longer than 70 characters, not counting the two leading hyphens.

The boundary delimiter line following the last body part is a distinguished delimiter that indicates that no further body parts will follow. Such a delimiter line is identical to the previous delimiter lines, with the addition of two more hyphens after the boundary parameter value.


Enough talking about boundary parameter, let’s see with examples…

File Upload

If you run the example at link Python Flask File Upload, you will see the similar kind of data as shown below.

I have uploaded here an image file using Mozilla FireFox browser (you can use any browser).

Clicking on the Network tab of the browser debug tool you will find such information.

Request method: POST

URL: http://localhost:5000

Request Headers: Content-Type:multipart/form-data; boundary=---------------------------293582696224464



Content-Disposition: form-data; name="file"; filename="roytuts.jpg"

Content-Type: image/jpeg

<content of the file>


In the above example the boundary is defined by ---------------------------293582696224464 and the content is written inside the boundary delimiter or marker.

At the end of the boundary marker you will see -- which indicates the end of the boundary.

If you run the file upload example using Restlet client then you will see similar to the below value for the boundary parameter in Content-Type.

Content-Type:	multipart/form-data; boundary=----WebKitFormBoundarydMIgtiA2YeB1Z0kl

Arbitrary Boundary

Here is an example of arbitrary boundary in multipart/form-data:

Content-Type: multipart/form-data;; charset=utf-8; boundary="----arbitrary boundary"

----arbitrary boundary
Content-Disposition: form-data; name="foo"

----arbitrary boundary
Content-Disposition: form-data; name="bar"

----arbitrary boundary--

Thanks for reading.

Leave a Reply

Your email address will not be published. Required fields are marked *