Agent WranglersRequests and files Required
Check every uploaded file
Accept only the file types you need, check them by content, limit their size, and store them where they cannot run.
How to do it
Read the first bytes to find the type, and don't trust the name or the browser's type. Set a size limit per type, such as 10 MB for images, in the web server and in the app. Give every file a random name. Store it outside the web folder or on a separate domain. Serve it with X-Content-Type-Options: nosniff and Content-Disposition: attachment unless it is a known image. Treat SVG as active content, because it can hold scripts. See also confirm every upload on the server and scan files for malware before anyone opens them.
Example
HTTP/2 200
content-type: application/octet-stream
content-disposition: attachment; filename="upload.bin"
x-content-type-options: nosniffHow to check
The agent uploads a harmless HTML file renamed to .jpg, a huge file and a file named ../../marker.txt. All are refused, or stored under a random name that never runs.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/safe-file-uploads.