Upload endpoint returns 500 for unknown Reflex-Event-Handler header

[harsh21234i]

Describe the bug

The upload endpoint validates that Reflex-Client-Token and Reflex-Event-Handler headers are present, but then looks up the handler with direct registry indexing:

token, handler_name = _require_upload_headers(request)
registered_event_handler = RegistrationContext.get().event_handlers[
    handler_name
]

If the header names a handler that is stale, misspelled, removed after a deploy, or otherwise not registered, the backend raises KeyError and returns a server error instead of a controlled 4xx response.

This is a backend robustness issue for uploads. A stale browser tab after a deploy can still have the old generated upload handler name, and malformed requests can produce noisy backend errors rather than a clear client error.

To Reproduce

Steps to reproduce the behavior:

1. Run any Reflex app that has the upload endpoint enabled, for example an app with an rx.upload(...) component.
2. Send an upload request with required headers present but an unknown handler name:

curl -i \
  -X POST http://localhost:8000/_upload \
  -H 'Reflex-Client-Token: repro-token' \
  -H 'Reflex-Event-Handler: no.such.State.handler' \
  -F 'files=@example.txt'

3. Observe that the backend takes the direct registry lookup path and raises KeyError for the unknown handler.

• Code/Link to Repo: current main, packages/reflex-components-core/src/reflex_components_core/core/_upload.py, in upload(app).upload_file.

Expected behavior

The upload endpoint should return a controlled 4xx response, such as 400 Bad Request or 404 Not Found, with a message like Unknown upload event handler. It should not raise an unhandled KeyError or return a 500 for a malformed/stale upload handler header.

Screenshots

N/A.

Specifics (please complete the following information):

• Python Version: N/A, source-level issue
• Reflex Version: current main as of 2026-08-08
• OS: OS-independent
• Browser (Optional): N/A

Additional context

Suggested fix: replace the direct event_handlers[handler_name] lookup with a guarded lookup and raise HTTPException(status_code=400 or 404, detail=...) when the handler is not registered. A focused unit test could live near the existing upload endpoint tests in tests/units/test_app.py and assert that an unknown reflex-event-handler returns a 4xx response without dispatching an event.

Duplicate search performed before filing:

• "Reflex-Event-Handler" unknown handler upload KeyError
• "reflex-event-handler" "KeyError"
• upload endpoint unknown event handler 500
• PR search for upload unknown handler KeyError reflex-event-handler

I did not find an existing issue or PR for this specific behavior.

[linear-code]

ENG-10989

[harsh21234i]

Additional validation against current main:

I reproduced this through the actual ASGI upload route using Starlette TestClient with raise_server_exceptions=False.

• POST /_upload with reflex-client-token and an unknown reflex-event-handler returned 500 Internal Server Error.

• The adjacent missing-header case returned the existing controlled 400 response: Missing reflex-client-token or reflex-event-handler header.

That confirms the unknown-handler path currently falls through to an unhandled registry lookup exception instead of returning a controlled 4xx response.