Checks on the server
- Cap file size before reading the whole body.
- Allow-list extensions and verify the content, not only the Content-Type header the client sent.
- Reject archives and executables unless the feature needs them.
Store and serve safely
- Rename files to random names and keep the original name as metadata only.
- Keep uploads in object storage, not in your app's web root.
- Serve user content with Content-Disposition: attachment or from a separate domain so scripts in it cannot act as your site.
- Send X-Content-Type-Options: nosniff.
Images and documents
Re-encode images on the server to strip embedded data. Scan documents for malware if other people will open them.
Frequently asked questions
Is checking the file extension enough?
No. Extensions are easy to fake. Inspect the content and restrict where files are served from.