Chunked Upload with Checksum

Compute a file hash before chunked upload and send it during assembly for integrity verification.

(function() {
 var logEl = document.getElementById('log');
 function log(m) { var d = document.createElement('div'); d.className='pkg-log-entry'; d.textContent=m; logEl.appendChild(d); logEl.scrollTop=logEl.scrollHeight; }
 new MultipleUpload('#demo', {
 uploadUrl: '/api/upload',
 multiple: true,
 chunked: true,
 chunkSize: '1MB',
 computeHash: true,
 hashAlgorithm: 'sha256',
 onHashComputed: function(task, hash) {
 log(task.fileName + ' SHA-256: ' + hash.slice(0, 24) + '...');
 },
 onTaskComplete: function(task) {
 log(task.fileName + ' uploaded with verified checksum');
 }
 });
})();

Hashing and chunking together

Turning on computeHash alongside chunked gives the server a checksum for a file it will receive in pieces, which is what lets it verify the reassembled result rather than trusting that the parts arrived intact.

The hash comes first, and costs time

The file has to be read end to end before the first chunk can be sent, so on a large file there is a visible delay before any progress appears. CRC32 keeps that short; SHA-256 is meaningfully slower but is the one to use if the hash decides anything security-relevant. Either way the server must compute its own from the bytes it received — a client-supplied hash describes a file nobody else has seen.