Handle server-side validation using the FileValidating event on postback. This demo accepts normal files and rejects empty uploads, path traversal names, and .tmp files when you submit the page.
FileValidating
.tmp
<!-- .aspx markup --> <au:AjaxFileUpload ID="Uploader1" runat="server" AutoUpload="true" ButtonText="Upload File" ShowProgress="true" OnFileValidating="Uploader1_FileValidating" /> <!-- Code-behind (.aspx.cs) --> protected void Uploader1_FileValidating(object sender, FileValidatingEventArgs e) { if (e.FileSize == 0) { e.Cancel = true; e.CancelReason = "Empty file."; return; } if (e.FileName.Contains("..")) { e.Cancel = true; e.CancelReason = "Invalid filename."; return; } }