Upload validation is the gate between an untrusted file and the rest of a media system. It should check the real content, enforce resource limits, and keep rejected files away from public delivery. Validation also improves the editor’s experience by catching problems while the source is still easy to replace.
Validate in layers
Check the declared type and extension for a quick response, then inspect the file signature and try decoding it with a trusted parser. Set limits for file size, pixel dimensions, duration, and processing time. A tiny compressed file can expand into a large processing job, so bytes alone are not enough.
Treat metadata as input
EXIF, captions, filenames, and embedded descriptions can contain sensitive or unexpected values. Strip or retain metadata according to the use case; do not publish it accidentally. Generate a safe storage key instead of using the submitted filename as a path.
Give actionable errors
“Upload failed” sends people back to guessing. Return a reason such as unsupported codec, dimensions below the required minimum, corrupt file, or missing rights field. Preserve the upload attempt ID in logs so support can trace the rejection without exposing the file publicly.
Test the gate
Include a good file, a wrong extension, a corrupt image, an oversized media file, and a file with unusual metadata. Confirm rejected files never reach the public CDN or the approval queue. Recheck the rules when a new format or conversion tool is added.
A concrete example
A user renames a large video to end in .jpg. Extension validation alone would send it to an image processor. Content inspection rejects it before transformation and returns the actual reason. A second test with a valid JPEG carrying a huge pixel count checks the resource limit.
Related reading
- Media Workflow Automation: A Practical Starting Guide
- Use Checksums for Media Integrity and Duplicate Detection
- Folders vs a DAM: When a Media Library Needs More Structure
Primary reference
The OWASP file upload guidance provides the underlying technical reference for this workflow.
Related field note
Continue with What breaks first in bulk transformation jobs.
Related field note
Continue with How to test video processing orchestration before launch.