MIME Sniffing vs Extension Checks
Prevent spoofed uploads by combining extension allowlists with content-based MIME detection.
Extension Checks Are Necessary But Insufficient
Extensions are user-controlled metadata. They are useful for UX and routing, but they are not reliable indicators of content type. Attackers commonly rename payloads to pass superficial allowlists.
Use extension checks to enforce product policy, then validate with signature-based sniffing and parser probes.
Build a Three-Way Type Decision
Accept only when detected type is in your allowlist and does not conflict with policy-critical expectations. Log all mismatches for abuse analytics.
- Declared type: request Content-Type header.
- Expected type: extension-to-policy mapping.
- Detected type: content signature and parser result.
Operational Guidance
Treat type mismatch as high-risk for executable or archive classes. For ambiguous formats, quarantine and scan asynchronously. Keep a small corpus of known-tricky samples in regression tests, including polyglot files and malformed headers.