HTTPS file upload DLP test (HTML5)
Accepted files
A common action — drag a file into the browser and upload it to a file share, cloud storage, or as a mail attachment. DLP should see that action and, with the right policies, respond. Upload a test file to our server and compare what you see under Accepted files with what your DLP reports. The file stays on this page for one hour and is visible only to you.
curl
curl -sS -X POST https://dlpbench.com/api/upload/html5/ -F "file=@./hello-dlp.txt" # Plain text with no identifiers: the request should arrive. If it fails, check the network or an overly strict policy.
curl -sS -X POST https://dlpbench.com/api/upload/html5/ -F "file=@./us-name-ssn-passport-30.csv" # Test SSN and card: with DLP configured the request should not leave. If you get ok — the channel was not stopped.
File upload FAQ (HTML5)
How does HTML5 differ from the online form and jQuery?
Here one file leaves — from disk or drag-and-drop. The online form sends text fields only, no attachment. jQuery handles files with a JS script. Test all three: DLP may catch an attachment and miss field text, or the reverse.
How do I know DLP did not stop the upload?
A row with the file name appears under Accepted files. If the request dies or there is no response, check the DLP log — the block likely worked.
Do I need HTTPS decryption for the policy to fire?
For DLP this is a standard control channel. Without TLS/SSL decryption, an agent on the workstation will not see the payload.
Where do I get a file for the test?
Use the panel on the right or Sample data — XLSX and PDF with SSN, IBAN, cards, plus document samples. Build repeatable sets in the generator. Start with a neutral file that has no identifiers, then the same channel with synthetic data.
If the file arrived and DLP also sees it, run the same set through the jQuery upload method — policies often treat form fields and attachments differently.
Keep testing exfil channels
On the same HTTPS path, try a multi-file scripted upload or another sample set.