Draw the path a file takes from browser to storage to any later reader, mark each trust boundary, and walk it with STRIDE. For uploads, the main threats are executable content, spoofed types, oversized files, unauthorized uploads and unsafe storage. OWASP lists a concrete defense for each.
Step 1: draw the flow
Keep it to five boxes: the user, the upload endpoint, a processing step such as image resizing or a scanner, storage, and the place where files are served or opened. Trust boundaries sit between the user and the endpoint, and between the endpoint and storage.
Step 2: walk it with STRIDE
| STRIDE | Upload example | Defense from OWASP guidance |
|---|---|---|
| Spoofing | Client lies about file type | Validate the real file type, not the Content-Type header |
| Tampering | Overwriting another user's file, path tricks | Generate the stored filename on the server |
| Repudiation | Nobody can tell who uploaded what | Require authentication; log uploads |
| Information disclosure | Guessable URLs expose private files | Map IDs to filenames through an application handler |
| Denial of service | Huge files or archives that expand | Cap size, including decompressed size |
| Elevation of privilege | Uploaded script runs on the server | Allowlist extensions, store outside the webroot or on a separate host |
The right column follows the OWASP File Upload Cheat Sheet. The first four columns are our mapping of its advice onto STRIDE.
Step 3: add the extras OWASP lists
- Scan content for malware with antivirus or a sandbox.
- Run supported document types such as PDF or DOCX through Content Disarm and Reconstruct.
- For images, decode and re-encode them, which strips metadata.
- Configure and update the libraries that process files.
- Protect the upload action against cross-site request forgery.
Step 4: decide and record
For each row, pick one response: mitigate, eliminate, transfer or accept. Write the owner and the reason. If you accept a risk, say why.
Step 5: turn it into tests
Good upload tests include a file with a mismatched extension and content, an oversized file, a request without a session, and a request for another user's file ID. Run these against a deployed test environment.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a running web app is probed, which is where upload tests like these end up.
Quick check
Is checking the file extension enough?
No. OWASP says to allowlist extensions but also to validate the real file type and not trust the Content-Type header, because clients can spoof it.
Where should uploaded files live?
OWASP advises a separate host if possible, otherwise outside the webroot, with public access mapped through an application handler.
A note on tooling
Safeguard covers the dependency side of an upload feature: SBOM and dependency scanning for the image and document libraries you use, plus reachability analysis. Try the free scan.
Sources
Last reviewed: 19 October 2026.
