Q268: Secure File Upload Validation and Download Safety

What Interviewers Want To Evaluate

Interviewers want to know whether you understand that files are untrusted input and downloads are security-sensitive output.

They want to hear about type validation, size limits, scanning, storage, signed URLs, content disposition, preview safety, and user feedback.

Short Interview Answer

Secure file handling treats every upload as untrusted. I validate size, extension, MIME type, and actual content server-side, store files outside executable paths, scan when risk requires it, generate safe names, restrict access with authorization or signed URLs, and serve downloads with correct Content-Type, Content-Disposition, and security headers. The frontend should pre-validate for UX, but server-side validation and storage rules enforce safety.

Detailed Interview Answer

File upload looks simple in UI.

It is not simple as a system boundary.

An uploaded file can be:

too large
wrong type
malicious
renamed to bypass filters
private
executable in the wrong context
expensive to process
dangerous to preview

The frontend can guide the user.

The server must enforce the rules.

Frontend Validation

Frontend validation improves UX.

Check:

file count
file size
visible extension
declared type
drag-and-drop constraints
progress state
cancel behavior

But never trust it.

Users can bypass browser UI or call the API directly.

Server Validation

Server validation should check:

authenticated user
authorization for target object
file size
file count
content type
magic bytes
malware scan where needed
image decoding safety
metadata stripping
quota
rate limits

Do not rely only on the filename.

Do not rely only on the browser-provided MIME type.

Storage Rules

Store uploads safely.

Prefer:

object storage
generated file names
private buckets by default
metadata in database
virus scan status
owner and permission records

Avoid storing user uploads in paths where they can execute as application code.

Avoid trusting user-provided names as filesystem paths.

Preview Safety

Previewing files can be risky.

Images, PDFs, SVGs, HTML, and office documents have different risk profiles.

SVG can contain script-like behavior depending on context.

HTML uploads should not be served as active same-origin pages.

Use sandboxed preview, separate origin, or forced download for risky formats.

Download Headers

Important headers:

Content-Type
Content-Disposition
X-Content-Type-Options: nosniff
Cache-Control
Content-Security-Policy

Content-Disposition: attachment tells the browser to download instead of render inline.

Use it for files that should not execute in the app origin.

Signed URLs

Signed URLs can grant temporary access to private files.

Good signed URLs are:

short-lived
scoped to one file
scoped to one action when possible
not logged casually
revocable through storage policy or key rotation

Do not make sensitive files public forever for frontend convenience.

Upload UX

Good upload UX includes:

allowed file types
max size
progress indicator
cancel
retry
virus scan pending state
clear error messages
post-upload processing state

If scanning is asynchronous, do not show the file as ready before it is safe.

Interview Example

If asked, "How would you add PDF upload to this app?"

Answer:

"I would pre-validate file size and type in the UI, then enforce size, MIME, magic-byte, and ownership checks server-side. I would store the file in object storage with a generated name, scan it if needed, serve it through authorized or signed URLs, and use safe download or sandboxed preview headers."

Common Mistakes

Common mistakes include:

trusting client-side validation
trusting file extension only
serving uploads from same executable origin
allowing unlimited file size
not checking ownership on download
using public buckets for private files
previewing risky files unsandboxed
not handling scan pending states

Senior-Level Framing

The senior framing:

"File handling is untrusted input plus controlled output. I design validation, storage, scanning, access control, preview, and download headers as one flow."

Practice Prompt

Design upload and download for:

resume PDF
profile photo
study notes markdown
exported handbook PDF
recorded mock interview audio

For each, define frontend validation, server validation, storage, preview, and download behavior.

Final Mental Model

A file is never just a file.

It is data from an untrusted boundary that may later become content, preview, download, or executable browser input.

Treat the whole lifecycle as security-sensitive.