Magic Byte MIME Validation

Validate file types by reading binary magic bytes, not just the extension.

(function() {
 var logEl = document.getElementById('log');
 function log(m) { var d = document.createElement('div'); d.className='pkg-log-entry'; d.textContent=m; logEl.appendChild(d); logEl.scrollTop=logEl.scrollHeight; }
 new MultipleUpload('#demo', {
 uploadUrl: '/api/upload',
 multiple: true,
 allowedMimeTypes: 'image/jpeg,image/png',
 validateMimeByMagic: true,
 onValidationError: function(msg, name) { log((name||'file') + ': ' + msg); }
 });
})();

Test: Rename a .txt file to .jpg and try uploading. Magic byte validation will catch the mismatch.

Checking the bytes, not the name

validateMimeByMagic defaults to false. Turned on, the component reads the first 32 bytes of each file and identifies the format from its signature, comparing that against allowedMimeTypes rather than trusting the extension.

What it does and does not prove

It reliably catches a file whose name lies about its contents, which is the common accidental case and the simplest deliberate one. It does not make the file safe: a genuine image can still carry a payload aimed at whatever processes it later. This narrows the input; it does not sanitise it.

The check runs in the browser, so it is a convenience for the user rather than a control. The server has to inspect its own copy.