README


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

xf
==
xf (xfer) is a single-file HTTP file transfer server. Every directory under
the served root renders as one web page that lists its entries with download
links and provides a form to upload one or more files into that directory.


Build
-----
Build a binary with the Go toolchain:
    go build -o xf .
Everything, including the web page, is embedded in main.go. There are no
third-party dependencies.


Run
---
Serve the current directory on loopback port 8080:
    ./xf
Serve a different directory or bind a different address:
    ./xf -dir /srv/files -addr 192.0.2.10:9000
Open the printed address in a browser. Uploads are streamed to a temporary
file in the target directory. All files in a request are staged before any are
renamed into place. Existing regular files are overwritten atomically and keep
their mode; new files are created mode 0600.


Options
-------
    -addr         listen address (default "127.0.0.1:8080")
    -dir          directory to serve (default ".")
    -max-upload   maximum bytes in one upload request (default 1073741824)


Debug
-----
The access log goes to standard output, one line per request:
    2026/07/02 10:14:38 get "/hello.txt" -> 200 (6 bytes) from 127.0.0.1
    2026/07/02 10:14:39 upload "/sub/up.txt" (9 bytes) from 127.0.0.1
Startup and error diagnostics go to standard error. To exercise the server
without a browser:
    curl -F files=@somefile http://127.0.0.1:8080/
    curl -O http://127.0.0.1:8080/somefile


Security
--------
xf has no authentication. It serves every file under the directory, including
hidden files, to anyone who can reach the address, and it accepts uploads from
anyone. The default listener is loopback; binding another address deliberately
exposes the server to that network.

Filesystem access is confined to the served root. Relative symbolic links may
point elsewhere inside the root, but absolute links and links that escape it
are rejected. Upload requests are limited to 1 GiB by default and at most 1000
multipart parts. The server does not limit upload duration or concurrent
requests. Run it only on systems and networks you trust.

An interrupted process can leave a mode-0600 .xf-upload-* staging file.
These reserved names are neither listed nor served and can be removed when no
xf process is using the directory. A rare rename failure while committing a
multi-file request can leave an initial subset committed.