File Type Validation: A Complete Security Guide

File type validation is critical for security. Relying only on extensions is dangerous.

Three Layers of Validation

1. Extension Check

Allowlist of accepted extensions. Easily bypassed by renaming.

2. MIME Type

Check Content-Type header. Can be spoofed by client.

3. Magic Bytes (Most Secure)

Read file header bytes to verify true type:

const magicNumbers = {
  'application/pdf': [0x25, 0x50, 0x44, 0x46], // %PDF
  'image/png': [0x89, 0x50, 0x4E, 0x47],
  'image/jpeg': [0xFF, 0xD8, 0xFF],
};

Best Practices

1. Use all three layers
2. Never trust client-side validation alone
3. Scan for viruses
4. Store files outside web root
5. Set proper Content-Type headers

Download safe sample files from SampleFiles.