File upload is one of the most common features in web applications—but it’s also one of the most targeted by attackers.
Imagine a user uploads a file named:
invoice.pdf.exe
Or renames a malicious executable to:
resume.pdf
If your application trusts only the file name or extension, you could expose your server to serious security risks.
A secure file upload system should never rely on a single validation step.
1. Validate the File Extension
Allow only the file types your application actually needs.
Example:
- ✅
.pdf - ✅
.jpg - ✅
.png - ✅
.docx
Reject everything else.
Remember: This is your first line of defense—not your only one.
2. Verify the MIME Type
Don’t trust the extension alone.
Check the file’s MIME type sent by the client.
For example:
application/pdfimage/jpegimage/png
Keep in mind that MIME types can also be spoofed, so continue with additional checks.
3. Validate the File Signature (Magic Numbers)
The most reliable validation is checking the file’s binary signature.
For example:
- PDF →
%PDF - PNG →
89 50 4E 47 - JPEG →
FF D8 FF
If the file signature doesn’t match the expected format, reject the upload.
4. Limit File Size
Prevent attackers from uploading extremely large files.
Example:
- Images: 5 MB
- Documents: 20 MB
This reduces the risk of storage abuse and denial-of-service attacks.
5. Rename Uploaded Files
Never store files using the original filename.
Instead, generate a unique name.
Example:
3b8b2d1d-ef7d-4db2-8a8c-0f5d91a0f4a7.pdf
This avoids filename collisions and reduces information disclosure.
6. Store Files Outside the Web Root
Avoid storing uploaded files in directories that can execute code.
Instead:
- Store files outside the web root.
- Serve them through a controller or API after authorization.
This prevents direct execution of uploaded files.
7. Scan for Malware
Integrate an antivirus solution to scan uploaded files before making them available.
This is especially important for systems that accept documents from external users.
8. Restrict File Permissions
Uploaded files should never have execute permissions.
Grant only the minimum permissions required to read or write the file.
9. Authorize Access
Not every uploaded file should be publicly accessible.
Always verify that the requesting user has permission to download or view the file.
10. Log Upload Activity
Record important details such as:
- User ID
- IP address
- File name
- File size
- Upload time
- Validation failures
Logs help detect suspicious activity and support incident investigations.
Final Thoughts
Secure file uploads are about defense in depth.
Don’t rely on a single validation.
A robust upload pipeline should include:
- Extension validation
- MIME type verification
- File signature checks
- Size limits
- Malware scanning
- Secure storage
- Proper authorization
Security isn’t a single feature—it’s a combination of small decisions that work together to protect your application.
