Step 6 — Validate uploads and publish them atomically

Filename and Content-Type are claims from the client. A public file needs byte, size, extension, and integrity checks before it enters the public directory.

1. Check an allowlisted MIME and maximum size.
2. Verify the actual PNG/JPEG/WebP/GIF/AVIF signature.
3. Write an exclusive random temporary file in the same directory, then atomically rename it.
4. Record SHA-256 and a bounded audit detail, not the file or sensitive values.
5. Keep private user files separate from public mounts; quarantine invalid files for later cleanup.

Codingstairs Admin cover assets preserve their original public format but use MIME/signature checks and atomic rename. Pryzeet user images have a separate sharp/private-storage pipeline. Sharing one helper would blur visibility and deletion ownership.

The error should state supported formats, size limits, and how to select another file. Rejecting before the public write prevents partial files and stale cache surprises.

Read next

• Upload signatures and atomic save
• Next step