File Mime Type Checking

Question

I am allowing uploading of files to my C# MVC website, I am restricting those types based on extension at the moment, but also feel I need a server side check to confirm they haven't just renamed it.

Is there a technique that I can use to check all the types I need or a library I can use that will help here?

I have seen people checking the first few bytes of the file, but I am scared I will miss something?

Thanks for your help.

Edit:

There are a lot of suggestions here. I will investigate some of these as a solution.

Solution 1

I ended up mixing some solutions from here, because I am not using the HttpFileBase and only have the file stream, I had to read the first few bytes of the stream to determine the mime type.

Note: I don't use the registry technique because I don't know what will or wont be installed on the servers.

Solution 2

If you are reading the file as an HttpPostedFile you can get the content type which is equal to the mime type.

So then you can do the following:

if (myFile.ContentType == "video/mpeg")
{
   // Do your thing
}
else{
   // error
}

Comments

[Maksim Vi.]

stackoverflow.com/questions/4019874/…