File Type Validation with Magic Bytes (Not File Extension)

Relying solely on file extensions (like .pdf or .jpg) or the client-supplied Content-Type header is dangerous. An attacker can easily rename malware.exe to invoice.pdf and bypass standard filters. True file validation requires inspecting magic bytes.

What Are Magic Bytes?

Magic bytes (file signatures) are specific hexadecimal byte sequences located at the exact beginning of a file:

Detecting Magic Bytes in Node.js with file-type

npm install file-type

import { fileTypeFromBuffer } from 'file-type';

export async function validateActualFileType(buffer: Buffer, expectedMime: string): Promise<boolean> {
  const detected = await fileTypeFromBuffer(buffer);

  if (!detected) {
    console.error('Unknown or unsupported binary structure.');
    return false;
  }

  console.log(`Detected true format: ${detected.ext} (${detected.mime})`);
  return detected.mime === expectedMime;
}

Reading Magic Bytes in the Browser

You can read the first 16 bytes of any File or Blob without loading the whole file into RAM:

export async function checkPdfHeaderInBrowser(file: File): Promise<boolean> {
  const headerBlob = file.slice(0, 4);
  const arrayBuffer = await headerBlob.arrayBuffer();
  const bytes = new Uint8Array(arrayBuffer);

  // %PDF in ASCII is [0x25, 0x50, 0x44, 0x46]
  return bytes[0] === 0x25 && bytes[1] === 0x50 && bytes[2] === 0x44 && bytes[3] === 0x46;
}

Security Gotchas

• Polyglot files: Files crafted to be simultaneously valid JPEGs and executable scripts. Always pair magic byte validation with format re-encoding or sandboxed processing.
• DOCX/XLSX detection: Office documents are ZIP archives. Their magic bytes will report as application/zip. Use an OpenXML validator to check for word/document.xml inside the archive.