Implement a document download that avoids memory buffering and storage-path leakage.

Load document metadata, authorize its owner or support reader, then stream from private storage. Return a safe filename and never expose the storage key.

A 500 MB file starts downloading without allocating 500 MB in the API process; an unauthorized id reveals no metadata.

• Authorize before opening the blob.
• Do not buffer the whole file.
• Sanitize the download filename.
• Let the result own stream disposal.

I use database metadata as the authorization resource and the storage key only after access succeeds. Results.Stream transfers incrementally and can support seekable range requests for large downloads.

app.MapGet("/documents/{id:guid}/content", async Task<IResult> (
    Guid id, AppDbContext db, IAuthorizationService authorization,
    IPrivateFileStorage storage, ClaimsPrincipal user, CancellationToken ct) =>
{
    var document = await db.Documents.AsNoTracking()
        .SingleOrDefaultAsync(x => x.Id == id, ct);
    if (document is null) return Results.NotFound();

    var allowed = await authorization.AuthorizeAsync(user, document,
        new ReadDocumentRequirement());
    if (!allowed.Succeeded) return Results.NotFound();

    var stored = await storage.OpenReadAsync(document.StorageKey, ct);
    if (stored is null) return Results.NotFound();

    return Results.Stream(stored.Stream,
        contentType: document.ContentType,
        fileDownloadName: FileNames.ForDownload(document.OriginalName),
        lastModified: stored.LastModified,
        entityTag: stored.ETag,
        enableRangeProcessing: stored.Stream.CanSeek);
}).RequireAuthorization();

Streaming bounds application memory, while range support depends on a seekable stream or storage provider integration. The framework disposes the result stream after the response completes.

• The storage object is missing.
• The client disconnects.
• The filename contains control characters.
• The backend stream cannot seek.

• Use a storage stream that fails mid-read.
• Assert authorization occurs before open.
• Check Content-Disposition and content type.
• Verify no storage key appears.

• Calling ReadAllBytesAsync.
• Opening storage before authorization.
• Using an unsanitized filename in headers.
• Redirecting clients to a permanent public blob URL.