dragover needs to be prevented of default behavior or the browser shows the dropped file instead of allowing internal handling. I'm not sure if this is a bug in the API but found this as a suggested solution in various places.