xf

xf (xfer) is a single-file HTTP file transfer server. Every directory under the served root renders as one web page that lists its entries with download links and provides a form to upload one or more files into that directory.

Build

Build a binary with the Go toolchain: go build -o xf . Everything, including the web page, is embedded in main.go. There are no third-party dependencies.

Run

Serve the current directory on loopback port 8080: ./xf Serve a different directory or bind a different address: ./xf -dir /srv/files -addr 192.0.2.10:9000 Open the printed address in a browser. Uploads are streamed to a temporary file in the target directory. All files in a request are staged before any are renamed into place. Existing regular files are overwritten atomically and keep their mode; new files are created mode 0600.

Options

-addr         listen address (default "127.0.0.1:8080")
-dir          directory to serve (default ".")
-max-upload   maximum bytes in one upload request (default 1073741824)

Debug

The access log goes to standard output, one line per request: 2026/07/02 10:14:38 get "/hello.txt" -> 200 (6 bytes) from 127.0.0.1 2026/07/02 10:14:39 upload "/sub/up.txt" (9 bytes) from 127.0.0.1 Startup and error diagnostics go to standard error. To exercise the server without a browser: curl -F files=@somefile http://127.0.0.1:8080/ curl -O http://127.0.0.1:8080/somefile

Security

xf has no authentication. It serves every file under the directory, including hidden files, to anyone who can reach the address, and it accepts uploads from anyone. The default listener is loopback; binding another address deliberately exposes the server to that network.

Filesystem access is confined to the served root. Relative symbolic links may point elsewhere inside the root, but absolute links and links that escape it are rejected. Upload requests are limited to 1 GiB by default and at most 1000 multipart parts. The server does not limit upload duration or concurrent requests. Run it only on systems and networks you trust.

An interrupted process can leave a mode-0600 .xf-upload-* staging file. These reserved names are neither listed nor served and can be removed when no xf process is using the directory. A rare rename failure while committing a multi-file request can leave an initial subset committed.