title: make ASP.Net file upload secure
body: <p>I'm creating an ASP.Net form with a fileupload control which will then email the details of the form and the file to another admin. I want to ensure this secure (for the server and the recipient). The attachment should be a CV so I will restrict it to typical text documents.</p>
  
  <p>From what I can tell the best bet is to check that the file extension or MIME Type is of that kind and check it against the "magic numbers" to verify that the extension hasn't been changed. I'm not too concerned about how to go about doing that but want to know if that really is enough.</p>
  
  <p>I'd also be happy to use a third party product that takes care of this and I've looked at a couple:</p>
  
  <p>blueimp jQuery file upload
  <a href="http://blueimp.github.io/jQuery-File-Upload/" rel="noreferrer">http://blueimp.github.io/jQuery-File-Upload/</a></p>
  
  <p>and cutesoft ajaxuploader
  <a href="http://ajaxuploader.com/Demo/" rel="noreferrer">http://ajaxuploader.com/Demo/</a></p>
  
  <p>But blueimp one still seems to require custom server validation (i guess just being jQuery it just handles client-side validation) and the .net one checks the MIME-type matches the extension but I thought the MIME type followed the extension anyway.</p>
  
  <p>So,</p>
  
  <p>Do I need to worry about server security when the file is added as an attachment but not saved?
  Is there a plugin or control that takes care of this well?
  If I need to implement something for server validation myself is matching the MIME-type to the "magic numbers" good enough?</p>
  
  <p>I'm sure nothing is 100% bulletproof but file upload is pretty common stuff and I assume most implementations are "safe enough" - but how!?</p>
  
  <p>If it's relevant, here is my basic code so far</p>
  
  <pre><code>&lt;p&gt;Please attach your CV here&lt;/p&gt;
  &lt;asp:FileUpload ID="fileUploader" runat="server" /&gt;
  </code></pre>
  
  <p>and on submit</p>
  
  <pre><code>MailMessage message = new MailMessage();
  if (fileUploader.HasFile)
  {
      try
      {
          if (fileUploader.PostedFile.ContentType == "text")
          {
              // check magic numbers indicate same content type... if(){}
  
              if (fileUploader.PostedFile.ContentLength &lt; 102400)
              {
                  string fileName = System.IO.Path.GetFileName(fileUploader.PostedFile.FileName);
                  message.Attachments.Add(new Attachment(fileUploader.PostedFile.InputStream, fileName));
              }
              else
              {
                  // show a message saying the file is too large
              }
          }
          else
          { 
             // show a message saying the file is not a text based document
          }
      }
      catch (Exception ex)
      {
          // display ex.Message;
      }
  }
  </code></pre>