title: Why bother inspecting an uploaded file's content-type if the sender can lie about what it is?
body: <p>I'm writing an API that is hidden behind Azure's API Management tool. It can't be accessed unless APIM verifies the requester's access token as well as Azure subscription. In the API, we want to verify with the requester that we will only accept zip files.</p>
  <pre><code>if (request.PayloadFile.ContentType != &quot;application/zip&quot;)
  {
      throw new BadRequestException(&quot;Unable to accept payload content type&quot;);
  }
  </code></pre>
  <p>This is <strong>not</strong> a process attempting to mitigate a bad actor. The purpose is to simply verify that the developer is sending the expected data type. With that said, I made a small client that sends a non-zip format file and I simply set the content-type header in the request:</p>
  <pre><code>var fileContent = new ByteArrayContent(await File.ReadAllBytesAsync(filePath));
  fileContent.Headers.Remove(&quot;Content-Type&quot;);
  fileContent.Headers.Add(&quot;Content-Type&quot;, &quot;application/zip&quot;);
  fileAsFormData.Add(fileContent, &quot;payLoad&quot;, fileName: Path.GetFileName(filePath));
  </code></pre>
  <p>The API happily accepts this. So my question is twofold:</p>
  <ol>
  <li>Why would we even bother checking <code>ContentType</code> if it can be spoofed?</li>
  <li>Is there a way to get the true file type of the payload?</li>
  </ol>