I have an application where users can upload a file for us to perform some actions. The only expected filetype is JSON, and initially we restricted the uploads to be of type application/json.

• Youtube Application Octet Stream
• Opening Application Octet Stream

Oct 31, 2018  When IIS locates a file that does not have an extension, the Content-Type that is sent back to the browser is set to application/octet-stream. For more general information about how to open APPLICATION-OCTET-STREAM files, file extension application-octet-stream and registry you can read one of the following articles: Windows registry - Windows registry is included in modern Windows operating systems to replace the older INI files which also contained system configuration. I am having similar issues with users uploading PSD files using the media uploader. I have added this in the list like Andrea_r suggests. The strange thing is, is that I (admin) can upload PSDs no problem but another user (set as a site admin) can't upload and they get the following error: File type does not meet security guidelines.

However, we have one user who, when they try to upload JSON files gets errors. We can update the application to allow files of type application/octet-stream and get things working, but this seems semantically.

I don't know much about application/octet-stream. In my searches I haven't learned much more. It seems that some browsers may convert files to this type when they don't know what to do with it; sometimes this error can be thrown when a file extension is not present (we have tested it with and without and still get the same issue); and it seems like this type allows files of type .exe and whatever else to be uploaded.

Are there security risks if we allow users to upload files of type application/octet-stream? Why or why not?

1 Answer

After posting my question, it got me searching about my question from a different angle. I think my question is answered in this thread:

Bob Aman writes: Totally free music download sites limewire.

If you allow users to upload scripts and executables, you should make sure that anything uploaded via that form is never served back as anything other than application/octet-stream. Don't try to mix the Content-Type when you're dealing with potentially dangerous uploads. If you're going to tell users they have to worry about their own security (that's effectively what you do when you accept scripts or executables), then everything should be served as application/octet-stream so that the browser doesn't attempt to render it. You should also probably set the Content-Disposition header. It's probably also wise to involve a virus scanner in the pipeline if you want to deal with executables. ClamAV is scriptable and open source, for example.

Not the answer you're looking for? Browse other questions tagged securityfile-uploadfile-type or ask your own question.

Compatible with Windows 10, 8, 7, Vista, XP and 2000

Optional Offer for WinThruster by Solvusoft EULA Privacy Policy Terms Uninstall

What Are MIME Types?

A Multi-Purpose Internet Mail Extension (eg. “application/octet-stream”), also known as a MIME, is type of Internet standard originally developed to allow the exchange of different types of data files through e-mail messages. MIME types like application/octet-stream are classified into specific data categories such as Video, Audio, Image, and many more. This categorization provides instructions to your computer or mobile device about how these files should be opened / viewed.

Why Do I Need MIME Types Like application/octet-stream?

Categorizing MIME types like application/octet-stream into a data type such as “Application” allows your e-mail client or Internet browser to display the content as intended. For example, when you attach a digital camera photo file to an e-mail, an Image MIME type will be associated with that file to allow your recipient to view the photograph.

Here's how it works: Web servers (computers that host websites and e-mail) insert a set of MIME instructions into the beginning of a data transmission, such as an e-mail message or webpage, in the following format:

Content-Type: application/octet-stream

[Format Explanation: The MIME type, which in this example is “Application”, is separated by a forward slash (“/”) and followed by a subtype.]

This set of instructions tells your client application, such as an e-mail program (eg. Microsoft Outlook, Apple Mail) or web browser (eg. Google Chrome, Mozilla Firefox), which “player application” should be used to properly display the application/octet-stream content.

Youtube Application Octet Stream

Many modern web browsers include built-in components to display common data types such as image players (eg. GIF, JPEG), Adobe Flash Player, Javascript, and many more. Other less-common types of players must be downloaded separately in order to properly display the MIME content.

Opening Application Octet Stream

What Are The Most Common Problems Associated With application/octet-stream?

Sometimes you’ll find that your web browser or e-mail client is unable to properly display your application/octet-stream content. This could be due to one of two reasons:

1. You are missing the proper Application “player software” to display the application/octet-stream content.

2. Your Windows Registry contains an incorrect file extension (eg. XLS, PDF) association with the application/octet-stream MIME type.

How To Fix application/octet-stream Issues

Do I have the application/octet-stream “player application” installed?

The first step in troubleshooting issues with opening application/octet-stream content is to first make sure that you have the correct “player application” installed for this MIME type. Because there can be several (or even hundreds) of related software applications to application/octet-stream, it is very difficult for us to compile a comprehensive list.

Therefore, a key strategy in determining the correct application is to look for clues on what software programs might be related to application/octet-stream. Look at the naming of the subtype for clues about a related program (eg. Word, Excel) or software developer name (eg. Microsoft).

Furthermore, if you’ve been sent MIME type application/octet-stream as an e-mail attachment, look for the file extension of the attached file. This file extension (eg. PKG, LHA, LZH, etc.) can provide you with a clue of what “player application” is associated with this Application MIME. Take a look at our file extension list below to see if there are any clues to finding the right “player application”.

Do I have broken application/octet-stream file associations?

The second step in troubleshooting application/octet-stream issues is making sure that you have correct file associations in the Windows Registry. Installing and uninstalling programs can lead to incorrect file associations with application/octet-stream. Take a look at your Windows Registry settings to ensure that the MIME type is correctly associated with the “player application” and file extension.

WARNING: DO NOT edit the Windows Registry unless you are an advanced computer user with experience editing the Registry. Making an error in editing the Registry can create irreversible damage to your PC.

If you are not comfortable editing the Windows Registry, we highly recommend using an automated registry cleaning program, or taking you computer to a qualified professional.