File type validation in Express - Step-by-Step Execution

Concept Flow - File type validation

Receive file upload request

↓

Extract file info (name, mimetype)

↓

Check if file type is allowed?

No→Reject upload with error

Yes↓

Accept file and continue processing

↓

Send response

The server receives a file upload, checks its type, rejects if invalid, or accepts if valid.

Execution Sample

Express

const allowedTypes = ['image/png', 'image/jpeg'];
app.post('/upload', (req, res) => {
  const file = req.file;
  if (!file || !allowedTypes.includes(file.mimetype)) {
    return res.status(400).send('Invalid file type');
  }
  res.send('File accepted');
});

This code checks the uploaded file's mimetype and rejects it if not allowed.

Execution Table

Step	Action	File mimetype	Condition	Result	Response Sent
1	Receive upload request	image/png	Check if 'image/png' in allowedTypes	Yes	No response yet
2	Validate file type	image/png	Allowed type?	Yes	No response yet
3	Accept file	image/png	-	-	No response yet
4	Send success response	image/png	-	-	'File accepted'
5	Receive upload request	application/pdf	Check if 'application/pdf' in allowedTypes	No	No response yet
6	Validate file type	application/pdf	Allowed type?	No	No response yet
7	Reject file	application/pdf	-	-	No response yet
8	Send error response	application/pdf	-	-	'Invalid file type'

💡 Execution stops after sending response to client.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 4 or 8
file.mimetype	undefined	image/png or application/pdf	image/png or application/pdf	unchanged
allowedTypes	['image/png','image/jpeg']	unchanged	unchanged	unchanged

Key Moments - 2 Insights

Why does the server reject some files even if they are uploaded?

Because the file's mimetype is not in the allowedTypes list, as shown in execution_table rows 5-8.

What happens if the file mimetype matches an allowed type?

The server accepts the file and sends a success response, as seen in execution_table rows 1-4.

Visual Quiz - 3 Questions

Look at the execution table, what response is sent when the file mimetype is 'image/png'?

A 'Invalid file type'

B No response sent

C 'File accepted'

D 'File rejected'

💡 Hint

Check execution_table row 4 where mimetype is 'image/png'.

At which step does the server decide to reject a file with mimetype 'application/pdf'?

A Step 2

B Step 6

C Step 4

D Step 8

💡 Hint

Look at execution_table rows 5-8 for 'application/pdf' mimetype.

If we add 'application/pdf' to allowedTypes, how would the response change for that file type?

A It would be accepted and send 'File accepted'

B It would still be rejected

C Server would crash

D No response would be sent

💡 Hint

Refer to variable_tracker and execution_table rows 1-4 for allowed types.

Concept Snapshot

File type validation in Express:
- Extract file mimetype from upload
- Check mimetype against allowed list
- Reject with error if not allowed
- Accept and continue if allowed
- Always send response to client

Full Transcript

In Express, when a file is uploaded, the server reads the file's mimetype. It compares this mimetype to a list of allowed types. If the file type is not allowed, the server rejects the upload and sends an error message. If the file type is allowed, the server accepts the file and sends a success message. This process ensures only safe or expected file types are processed.