title: Does allowing file uploads of type application/octet-stream have security implications?
body: <p>I have an application where users can upload a file for us to perform some actions. The only expected filetype is JSON, and initially we restricted the uploads to be of type <code>application/json</code>.</p>
  
  <p>However, we have one user who, when they try to upload JSON files gets errors. We can update the application to allow files of type <code>application/octet-stream</code> and get things working, but this seems semantically.</p>
  
  <p>I don't know much about <code>application/octet-stream</code>. In my searches I haven't learned much more. It seems that some browsers may convert files to this type when they don't know what to do with it; sometimes this error can be thrown when a file extension is not present (we have tested it with and without and still get the same issue); and it seems like this type allows files of type <code>.exe</code> and whatever else to be uploaded.</p>
  
  <p>Are there security risks if we allow users to upload files of type <code>application/octet-stream</code>? Why or why not?</p>