From 874d87f157c7efa3e1ceb96e2f4387b66c00672e Mon Sep 17 00:00:00 2001 From: Yashar Fakhari Date: Mon, 13 Jul 2026 09:27:23 -0700 Subject: [PATCH 1/2] fix: don't send auth header for resumable upload PUT requests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit That upload URL is a pre-authenticated, opaque URL returned by createUploadSession; per Microsoft Graph's documented contract, it must not receive an Authorization header (the token is already embedded in the URL). Sending one anyway causes the fragment PUT to fail, the loop retries and eventually gives up, UploadFileViaResumableUploadInternal returns null. MaximumBasicFileUploadSizeInBytes = 4 * 1024 routes anything ≤4KB through the simple-upload path (which correctly uses the Bearer token against the real Graph endpoint) and anything larger through this resumable path. Ref doc: https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession?view=graph-rest-1.0#remarks 7/13/2026 > If you include the Authorization header when issuing the PUT call, it might result in an HTTP 401 Unauthorized response. Only include the Authorization header and bearer token when issuing the POST request during the first step. Don't include it when issuing the PUT call. --- Api/OneDriveGraphApi.cs | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/Api/OneDriveGraphApi.cs b/Api/OneDriveGraphApi.cs index dedf1df..a710e83 100644 --- a/Api/OneDriveGraphApi.cs +++ b/Api/OneDriveGraphApi.cs @@ -2468,9 +2468,6 @@ protected virtual async Task UploadFileViaResumableUploadInternal( throw new ArgumentNullException("oneDriveUploadSession"); } - // Get an access token to perform the request to OneDrive - var accessToken = await GetAccessToken(); - // Amount of bytes succesfully sent long totalBytesSent = 0; @@ -2489,8 +2486,10 @@ protected virtual async Task UploadFileViaResumableUploadInternal( // Defines a buffer which will be filled with bytes from the original file and then sent off to the OneDrive webservice var fragmentBuffer = new byte[fragmentSizeInBytes ?? ResumableUploadChunkSizeInBytes]; - // Create an HTTPClient instance to communicate with the REST API of OneDrive to perform the upload - using (var client = CreateHttpClient(accessToken.AccessToken)) + // Create an HTTPClient instance to communicate with the upload session's URL. Note that no bearer token is set here: + // oneDriveUploadSession.UploadUrl is a pre-authenticated, opaque URL with its own embedded access token, and Microsoft + // Graph rejects (some backends silently reject, others error) fragment uploads that also carry an Authorization header. + using (var client = CreateHttpClient()) { // Keep looping through the source file length until we've sent all bytes to the OneDrive webservice while (currentPosition < fileStream.Length) From 8fa68a3cc31195a4f7684d76a79ad17a6b7b27da Mon Sep 17 00:00:00 2001 From: KoenZomers Date: Wed, 15 Jul 2026 22:47:27 +0200 Subject: [PATCH 2/2] Adding changelog entry --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d9b9686..5b17ca7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ All notable changes to this project are documented in this file. +## [3.0.2.0] + +- Fixed a potential issue with larger file uploads [#49](https://github.com/KoenZomers/OneDriveAPI/pull/49). Thanks YasarF! + ## [3.0.1.0] ### Fixed