A few days ago I discovered something in one of my Express.js projects that made me uncomfortable. I was accepting image uploads using Multer and validating them based on MIME types and file extensions. At first glance it seemed secure enough, but then I started digging deeper and realized I was essentially trusting information provided by the client. The more I researched, the more I realized that file extensions can be changed and MIME types can be spoofed. A file claiming to be an image m...