Upload acceptance and publication are different states
An application may need to receive employee photos, certificates, support attachments or business documents. Successfully receiving bytes does not establish that the file is safe, correctly typed or authorized for public access. A deliberate lifecycle separates transfer, validation, quarantine, approval and delivery.
This guide describes a defensive application design, not a guarantee that one scanner can detect every harmful file. OWASP's upload guidance recommends several controls, including type checks, size limits, safe naming and appropriate storage. Apply controls according to the business formats actually required.
Setup: define permitted content and audience
List allowed formats, maximum size, intended users, retention and whether each file is public or private. Decide who may upload, replace, approve and download it. A certificate PDF and an employee photo may have different audiences even when they share the same storage provider.
Create server-generated storage identifiers rather than trusting a supplied filename as a filesystem path. Keep original names as safely displayed metadata where needed. Enforce limits while receiving data, not only after an unlimited body has been buffered. Include decompressed size or parser resource limits when the supported format can expand substantially.
Illustrative incident: a renamed file reaches the public library
An illustrative portal checks only a filename extension and publishes the object immediately. A file whose actual content does not match the declared type becomes publicly retrievable before deeper processing fails. This is a defensive teaching scenario, not a claim about an existing customer vulnerability.
Use harmless synthetic fixtures representing mismatched types, oversized content and invalid structure. Do not upload active malware to a shared environment to test the workflow. Capture validation decisions and object identifiers without copying private documents into general logs.
Troubleshooting: inspect lifecycle transitions
| Observation | Evidence | Investigation |
|---|---|---|
| Wrong content passes extension checks | Declared type, signature and parser result | Is validation trusting only client metadata? |
| Rejected files remain publicly accessible | Storage location and delivery rules | Did publication happen before approval? |
| One user reads another's attachment | Download authorization and object ownership | Is access checked for every request? |
| Uploads exhaust resources | Receive limits and processing concurrency | Is admission bounded before expensive work? |
The Content-Type header is supplied by the client and cannot be the only type check. File signatures and parsing also have limits, so combine controls rather than treating one signal as complete proof.
Corrective action through explicit states
Store new content in a non-public quarantine location with an operation record. Validate the allowed type and structure, perform the reviewed scanning or transformation, and publish only after the required checks and authorization succeed. Mark failures clearly and apply a controlled cleanup policy.
Keep private files behind authorized delivery even after validation. If using signed URLs or a CDN, review expiration, caching and revocation behavior. Replacing a file should create a traceable revision rather than silently overwriting an unrelated object. Avoid serving active content under the main application origin without a specific reviewed design.
Verification, delivery objective and SOP
Test accepted files, rejected types, excessive size, parser failure, unauthorized downloads and interrupted processing. Confirm that rejected or pending objects cannot be fetched through alternate URLs. Verify that deleting or revoking a record also follows the intended storage and cache-retention process.
An internal SLO can measure timely processing and authorized delivery of supported files. Security rejection is not an availability failure to be bypassed. A contractual SLA needs separate scope. The SOP should identify validation ownership, quarantine access, review procedures, object cleanup and incident evidence. Never put storage credentials or private attachment contents into deployment notification emails.
Explore custom application development and cloud security.
Technical reference
OWASP file upload guidance, reviewed 19 October 2026. Follow documentation matching the installed product version.