Web Security · Senior · Question 64 of 75
Why should file uploads be validated by content and not just by extension?
- 1Because browsers remove extensions on upload
- ✓Correct answer: Names and
Content-Typeare attacker-controlled; check magic bytes, size and parse in a sandbox - 3Because extensions are case-sensitive
Explanation
Store files outside the web root with generated names, scan them, and never execute or serve them from your main origin.