Spring MockMvc multipart tests: what the fixture proves

Assert state, not only status

The fixture sends valid, oversized, fake-format, invalid-UTF-8, empty and missing parts. For each rejection it checks that the temporary directory is empty; the accepted case checks the generated filename and exact stored bytes. Those assertions catch a controller that returns an error after leaving a staged file. The tests also show that a malicious original filename is ignored, but only inside a JUnit temporary directory.

MockMultipartFile already contains the test bytes. Standalone MockMvc bypasses the deployed servlet multipart configuration, reverse proxy, request-size enforcement and authentication filter chain. The budget lesson separates controller checks from parser limits. The readiness test uses a real local HTTP server for a different boundary.

Add a deployed route check

Before exposing uploads, test a real container with max-file-size and max-request-size, accepted and rejected MIME declarations, interruption during transfer, storage failure, auth, CSRF or bearer rules, and concurrent uploads. The current controller is not registered in ReceiptApplication. A successful standalone test cannot prove that the actual application serves POST /contract/imports.

Checked source

client.perform(multipart("/contract/imports").file(upload(
        "../../outside.csv", "text/csv", validCsv)))
    .andExpect(status().isOk());
assertEquals(1, storedFiles().size());

Verification boundary

MultipartReceiptImportTest runs five local tests covering accepted and rejected parts in the downloadable Spring source kit. The excerpt is shortened; the kit contains the complete test.

Costs and limits

These tests run without servlet-container parsing, deployment storage, authentication, request streaming or proxy limits. MockMultipartFile allocates its bytes in memory before the controller. The accepted test checks one short file; it is not a throughput benchmark.

Common Mistakes

• Do not call standalone MockMvc an end-to-end upload test.
• Do not assert only a 413 or 422 while ignoring staged files.
• Do not infer container max-request-size behavior from controller code.

Read next

Spring MVC multipart receipt import: validate before storing, Spring multipart size limits: enforce parser and application budgets, Spring Boot readiness health group: withdraw traffic on a required dependency failure, Spring tests: separate business rules, wiring and transport.