Client Validation

<div id="myUploader" class="mu-uploader">...</div>
<div id="errors"></div>

var uploader = new MultipleUpload(document.getElementById('myUploader'), {
 uploadUrl: '/api/upload',
 allowedExtensions: ['jpg', 'png', 'pdf'],
 maxFileSize: 2 * 1024 * 1024,
 maxFiles: 5,
 onError: function(file, error) {
 var div = document.createElement('div');
 div.style.cssText = 'color:#dc2626; padding:4px 0;';
 div.textContent = file.name + ': ' + error;
 document.getElementById('errors').appendChild(div);
 }
});

Rules checked before anything is sent

Extension, size and count limits are all evaluated in the browser, so a file that breaks one is refused immediately rather than after a wait. That is the entire value of client-side validation: it is a fast, friendly first pass.

It is not a security boundary

Every one of these rules can be skipped by posting to your endpoint directly, so the server has to repeat all of them — and enforce the size cap while writing bytes rather than trusting a declared length. Treat the client rules as a courtesy to the user, and the server rules as the ones that count.