File Upload in Mobile Chat: Full Implementation

Sending Files in Chat: Full Implementation

We've worked on dozens of projects where file sending in chat becomes a nightmare: iOS security scope leaks, empty files from iCloud, Android content:// URIs that can't be sent over the network. The task goes beyond a simple 'attach file' button: you need to properly handle the file picker on both platforms, correctly display file types, organize upload, and ensure secure download on the recipient's device. Here's how we do it.

How to handle file selection on iOS and Android?

On iOS, the system UIDocumentPickerViewController returns a URL with a security-scoped bookmark. File access is opened via startAccessingSecurityScopedResource() and must be closed via stopAccessingSecurityScopedResource() after copying to a temporary directory. As per Apple's official documentation, forgetting the second call causes a security scope leak, and the next time the app launches, access to the file is blocked by the system. We ensure these calls are always paired.

Files from iCloud Drive don't arrive immediately: NSMetadataQuery shows the download status. If the file isn't on the device yet, you must wait for NSMetadataUbiquitousItemIsDownloadingKey to finish before copying. Without that, you'll get an empty 0-byte file in the upload queue.

On Android, use Intent(Intent.ACTION_OPEN_DOCUMENT) with addCategory(Intent.CATEGORY_OPENABLE). The Uri from a content provider cannot be passed directly to network requests – you must copy the contents via contentResolver.openInputStream() into the app's cache directory. Files from Google Drive and other providers have no real filesystem path, only a content:// URI.

How to determine MIME type and icons?

We determine MIME by extension via UTType (iOS 14+) or MimeTypeMap (Android). On the server, we additionally check via magic bytes (the first bytes of the file). PDF starts with %PDF, ZIP with PK\x03\x04. This protects against renamed executable files. Comparison: extension check takes 1 ms but is mortal; magic bytes take 10 ms but detect 99.9% of fakes.

| File Type | Magic Bytes | | PDF | %PDF | | ZIP | PK\x03\x04 | | JPEG | \xFF\xD8\xFF | | PNG | \x89PNG |

In chat, we show icons by category: document, spreadsheet, archive, audio, other. We don't attempt to render previews for every type – only for PDF (via PDFKit on iOS or PdfRenderer on Android) and office formats via QuickLook / ACTION_VIEW with the system app.

How to manage file upload with progress using background sessions?

Upload follows the same principles as for video: chunking for files >5 MB, background session on iOS, WorkManager on Android. We use URLSessionBackgroundConfiguration on iOS and WorkManager with NetworkType.CONNECTED constraint on Android. Progress in bytes, not percentages – users understand '1.2 MB of 8.4 MB' better than '14%'. On iOS, background sessions allow upload to continue even after the app is closed – the user receives a notification upon completion.

How to ensure secure download with whitelist and presigned URLs?

For secure download, we use presigned URLs with TTL. Direct unauthenticated S3 links mean public access to private chats. Our engineers configure TTL so that links work for 10–15 minutes – enough for download but not for distribution. Maximum file size is 100 MB enforced at the API gateway level. A server-side whitelist of MIME types is mandatory. Executable files (.exe, .apk, .ipa, .sh) are blocked or scanned via antivirus (ClamAV, VirusTotal API).