MP4 content type returned as different MIME type in different browsers

Question

I have an ASP.NET application built using C# for the backend. I have a form that uploads a pdf and checks the MIME type, application/pdf, to verify it's a valid file. I need to do this on a seperate form for MP4 files but it didn't seem to work. It always returned false. I checked the returned MIME type FileUpload.PostedFile.ContentType in webkit which was perfectly accurate. Firefox 5 and IE 8, however, tested for text/csv and application/octet-stream, respectively. This makes absolutely no sense to me. I also tried mapping extensions to the correct MIME types in the web.config file like so:

<staticContent>
  <mimeMap fileExtension=".mp4" mimeType="video/mp4" />
  <mimeMap fileExtension=".m4v" mimeType="video/m4v" />
  <mimeMap fileExtension=".ogg" mimeType="video/ogg" />
  <mimeMap fileExtension=".ogv" mimeType="video/ogg" />
  <mimeMap fileExtension=".webm" mimeType="video/webm" />
</staticContent>

And in the backend CS file I used this to test the posted file's content type:

if (file.PostedFile.ContentType == "video/mp4" || 
    file.PostedFile.ContentType == "video/mpeg" || 
    file.PostedFile.ContentType == "video/ogg" || 
    file.PostedFile.ContentType == "video/quicktime" || 
    file.PostedFile.ContentType == "video/webm") 
        return true;
else
        return false;

Also please note I am using the local development server that comes with VS

Answer 1

It is the browser on the client side that determines the content type that gets sent to the server . That is the browser sends the header that ASP.NET uses to fill the HttpPostedFile.ContentType property.

You can't change this with IIS staticContent mime mappings , those settings apply only to files sent by the server to the client (not the other way around).

You'd better use some custom code in your c# method before the if-else block you posted, to (attempt to) determine the real mime type with a server side check . Take a look at those two methods, that lead to different results and performance:

1. Use reflection to call to a method in a internal .NET framework class (this simply matches the file extension with those known to the framework itself)
2. Use an un-managed call to a IE dll (this method should guess the mime type looking for magic bytes inside the file, as you can read in the MSDN documentation )

Note: generally speaking you should always check/determine the content type on the server and never rely on the one sent by the client (never trust HttpPostedFile.ContentType): it can be accidentally wrong (as happened to you), purposely changed by some hacky user, wrong because of a browser not complying to some standard (IE is known to send wrong mime types for some image formats)...