title: Restrict file types allowed for upload asp.net
body: <p>I want to limit the allowed uploaded file types to images, pdfs, and docs.  What is the recommended way to approach this?</p>
  
  <p>I assume checking the file extension alone is not enough, since an attacker can change the file extension as he wishes.</p>
  
  <p>I also thought about checking against MIME Type using PostedFile.ContentType.</p>
  
  <p>I still don't know if this is adding any further functionality than checking against file extensions alone, and if an attacker have and ability to change this information easily.</p>
  
  <p>This is basically for a course management system for students to upload assignments and teachers to download and view them.</p>
  
  <p>Thanks.</p>