Why not use enctype="multipart/form-data" always?

Question

By change I discovered that the django admin interfaces uses enctype="multipart/form-data" always.

I would like to adopt this pattern, but I am unsure if I see all consequences this has.

Why not use enctype="multipart/form-data" always?

Update

Since more than one year we use enctype="multipart/form-data" always in some forms. Works fine.

Amosamount

In my opinion multipart/form-data best use for file upload and transfer because there no characters will be encoded throughout the request.This value is required when you are using forms that have a file upload control and in other hands application/x-www-form-urlencoded is used to encode all the characters before sent (spaces are converted to "+" symbols, and special characters are converted to ASCII HEX values). – Sparid

@AnkitChaudhary I try to avoid conditions. I like it simple and straightforward. That's what the question is about: Why not use it always. I could not find an answer to this question in your comment. Please elaborate if I overlooked it. – Amosamount

@AnkitChaudhary you provided a link. I think "What does enctype='multipart/form-data' mean?" is a different question. – Amosamount

Answer 1

From the RFC that defines multipart/form-data:

Many web applications use the "application/x-www-form-urlencoded" method for returning data from forms. This format is quite compact, for example:

name=Xavier+Xantico&verdict=Yes&colour=Blue&happy=sad&Utf%F6r=Send

However, there is no opportunity to label the enclosed data with a content type, apply a charset, or use other encoding mechanisms.

Many form-interpreting programs (primarily web browsers) now implement and generate multipart/form-data, but a receiving application might also need to support the "application/x-www-form-urlencoded" format.

Aside from letting you upload files, multipart/form-data also allows you to use other charsets and encoding mechanisms. So the only reasons not to use it are:

• If you want to save a bit of bandwidth (bearing in mind that this becomes much less of an issue if the request body is compressed).

• If you need to support really old clients that can't handle file uploads and only know application/x-www-form-urlencoded, or that have issues handling anything other than ASCII.

Avian

I don't need to support really old clients. And I think the bandwith overhead is very small. Thank you for your answer. – Amosamount

Answer 2

There's a bit of overhead with using multipart/form-data for simple text forms. Compare a simple form with name and email.

Default (x-www-form-urlencoded)

Content-Type: application/x-www-form-urlencoded; charset=utf-8

name=Nomen+Nescio&email=foo%40bar.com

multipart/form-data

Content-Type: multipart/form-data; boundary=96a188ad5f9d4026822dacbdde47f43f

--96a188ad5f9d4026822dacbdde47f43f
Content-Disposition: form-data; name="name"

Nomen Nescio
--96a188ad5f9d4026822dacbdde47f43f
Content-Disposition: form-data; name="email"

[email protected]
--96a188ad5f9d4026822dacbdde47f43f

As you can see, you need to transmit a bunch of additional bytes in the body when using multipart encoding (37 bytes vs 252 bytes in this example)

But when you add the http headers and apply compression, the relative difference in payload would in most real life cases be much smaller.

The reason to prefer urlencoded over multipart is a small saving in http request size.

Chart

Answer 3

TL; DR

There's almost certainly no problem if you're targeting any modern browser and using SSL for any confidential data.

Background

The form-data type was originally developed as an experimental extension for file uploads in browsers, as explained in rfc 1867. There were compatibility issues at the time, but if your target browsers supports HTML 4.x and hence the enc-type, you're fine. As you can see here that's not an issue for all mainstream browsers.

As already noted in other answers, it is a more verbose format, but that is also not an issue when you can compress the request or even just rely on the improved speed of communications in the last 20 years.

Finally, you should also consider the potential for abuse of this format. Since it was designed to upload files, there was the potential for this to be used to extract information from the user's machine without their knowledge, or sending confidential information unencrypted, as noted in the HTML spec. Once again, though, modern browsers are so field hardened, I would be stunned if such low hanging fruit was left for hackers to abuse and you can use HTTPS for confidential data.

Apolitical

Answer 4

The enctype attribute specifies how the form-data should be encoded when submitting it to the server and enctype="multipart/form-data" is used when a user want to upload a file (images, text files etc.) to the server.

Turbit

Yes, every word you wrote is true. But it does not answer the question. AFAIK it does no harm if you always use enctype=“multipart/form-data”. That's the question. – Amosamount