Auto-generated transcript Let's talk about file uploads. File uploads are a necessary part of every single application and it is important to implement this very securely so you don't end up creating all sorts of vulnerabilities in your application. And this is especially important in the age of wipe coding and AI because we have a ton of new wannabe developers in the market nowadays who are building applications with AI and they have no idea how security works and they end up creating all sorts of different vulnerabilities in their application. And a lot of those vulnerabilities can be solved if you just implement file uploads securely. So there's about six or seven different things I want to go through in this video to help you implement more secure file uploads. The very first thing I want to talk about is pre-upload validations. So before even starting the upload the very first thing you should do is verify the properties of the uploaded file. For instance enforce size limits. If for instance you're trying to upload let's say an image files for like some sort of a profile picture component, it makes no sense to allow 100 MB or 200 MB uploads, right? You should limit the size of that image to, I don't know, 5, 10, 20 MB, depending on how high of a resolution you want on this image, right? And it also helps if you check the MIME types of what you're uploading. So if you're uploading, again, let's say an image, you want to make sure that the MIME types match, right? You want to make sure that the file extensions also match, right? you want to allow png jpeg etc etc but you don't want to allow let's say dot pdf or dot exe or something like that right you you don't want to allow like this right if you're trying to upload an image it makes no sense to allow extensions like these but if for instance you were building let's say a document picker then you would probably allow extensions like dot pdf right dot docx or something like that or even doc txt right you would allow extensions like that but you still would not allow something like dot exe right because that's extremely dangerous right you're literally allowing a entire executable file right who knows what that could run right so make sure you're allowing the right extensions and the mind types based on what exactly you're building right and make sure you're enforcing size limits as well this is the kind of stuff that you do before even starting the actual upload, right? So before you even start the upload process, you check all of these things on the actual file. And then if these things match, then you allow the actual upload to your server. And so number two is secure storage and execution. And this is actually super simple to implement. You want to make sure that you're always uploading and storing files on some sort of third-party object storage solution. So something like AWS S3, right? Or GCS on Google Cloud, right? Or other stuff like that, basically. You want to make sure that you're storing files on secure object storage like that and make sure you're never, absolutely never storing them on your app servers. So whatever VPS or server or EC2 instance or whatever you're using to run your actual application right the server where your application is actually hosted you want to never host files on that same server because that's just asking for trouble right now number three is malware scanning and sandboxing so in this step I want you to asynchronously scan the entire file for malware And you want to do this process asynchronously because this way the user doesn have to wait for the entire upload to finish right And you want to do this asynchronously because this way, once the upload is done from the user's side, their browser is free to do all sorts of other things, right? So once the file has been uploaded to your secure storage, which is not going to be the same as your app server, right? We talked about this before. Then you're going to run some sort of an antivirus or malware scanner on that file asynchronously in some sort of a background worker and make sure that the file has no viruses, right basically. And another awesome neat tip for making this even more secure is to use some sort of sandboxing procedures. So if you are able to sandbox the file or isolate it in some way Then you just make sure that there's no real threat to your server because the file is going to be isolated And even if you run the file, you're not going to actually harm your server So figure out a sandboxing approach that works for you Isolate the file and then run some sort of a malware scanner on it and make sure that there's no you know Shenanigans going on in the file now number four is renaming and sanitization and this step is very simple Well, well, there's two steps, but both of them are very simple You want to make sure that you rename every single file that's uploaded and you can use whatever format you want for this, right? Like the uploaded date or the user's username or something like that. But you want to make sure that you rename this file based on your own format and then also sanitize it. And this basically means you remove the metadata from the file, at least all of the metadata properties that you don't need, right? Which is going to be, in most cases, most of the metadata. data. So remove all of that, sanitize the file and rename it according to whatever format works best for you. And this just helps to make the file more secure and clean it up a bit because the original file name and the original file metadata is kind of gone, right? The actual file data is still there, but we just remove the name and the metadata basically. Now number five is access control and signed URLs. And I've got a lot to say on this. So there's two ways you can actually serve files to your user right there's the direct way where the user requests a file he goes to some page and you respond with that file right you the server sends that file directly to the user right that's one way the other way is to use some sort of a signed url procedure or some sort of a proxy server to deliver that file to the user and this just helps to make the entire the entire process so much more secure because you have much more control and you also introduce a little middleman in the entire chain, right? And depending on your implementation and your use cases and what kind of needs you have for this application, you can also set up signed URLs that are temporary and expire after a certain period of time, right? And then the user has to go and regenerate the link or something like that, right? Or they just get auto-regenerated when the user visits the same page again, right? But basically, you can have temporary URLs as well. And this makes the entire thing so much more secure because URLs are going to expire and users are not going to be able to use that same URL to access that file again. So even if for some reason you have a vulnerability that grants a malicious user access to certain files on your system, they're not going to last because the access to those files is going to be temporary, right? The links are going to expire And one more reason why we using signed URLs is because we don want to use direct paths to files This is a horrible way to implement file uploads and file access And when I say direct paths, I mean something like if you have a server at example.com and you have a file at, you know, folder slash folder slash file.txt. You do not want to have a server that allows direct paths like this. If I can go to a URL like this and access any file on your system, that's a horrible, horrible security decision. Instead of this, what I want to see is some sort of a signed URL. So let's say you have a media server hosted at the slash media URL, and then you have some sort of a file ID. Let's say some long UUID, like something like this is actually a lot more secure because you're not allowing direct paths. I can't just give you the direct path in the URL and then grab your files from you, right? That should never be possible. Use signed URLs. And if you can, make them temporary as well so that they expire after some time, right? Let's say 3,600 seconds. That's like one hour, right? They expire after some time. And this also allows you to track which person is viewing a file, what kind of requests are coming to that file, and so on and so forth. And that makes it so much easier to debug the entire thing in the future as well, right? And obviously, I feel like I need to say this because there's so many wipe coders nowadays. but make sure that the user who's actually viewing the file actually has the permissions to view that file as well right if it doesn't have the permissions to view that file then you need to block that request and potentially log it as well so that you can review it and you know deal with it later now number six is logging monitoring and rate limiting so let's talk about that you want to have good logging practices over here in your application so that you can actually track which person is trying to access which file does he have the permissions and so on and so forth and this works hand-in-hand with monitoring you want to have good logging and good monitoring systems on all of your file uploads and file access requests and stuff like that and if you have good logging and monitoring systems in place you can very quickly detect who's trying to access a file who's trying to act maliciously on your server and you can actually deal with that pretty quickly and this is also just great for debugging right if you don't have these things then you're gonna have a very hard time debugging your application when something inevitably goes wrong so make sure you have these systems in place now along with that you want to have rate limiting as well and the reason you need this is because people are going to abuse your system if you don't have some sort of rate limiting in your in your server let's say you have let's say you're hosting some large video files right you know that videos can be really large often in gigabytes right especially if you have a 4k video or something like that let's say you have a 5gb video file and you're hosting it on your server and you allow people to download it for free now if you don't have some sort of a rate limiting practice in place then people are just going to be able to download this again and again and again and that means five gigabytes of bandwidth leaving your server every single time someone downloads this and that is a lot of data right And if you're not careful with this, you're going to run into all sorts of cloud bills and expenses and so on and so forth. So you need to make sure that you have good rate limiting practices in place so that you're actually so that you don't get bankrupt, basically. Right. So that you don get 100K bill in your AWS invoices Right Because let me tell you if you have given a reasonably popular website and you don have rate limiting in place then depending on what kind of server you have and what kind of files you're serving, you can run into some really large bills and you're going to wake up one day and there's going to be an invoice in the mail from AWS or from Vercel and it's going to be pretty fucking big. So make sure you have good rate limiting in place as well now the very last thing i want to talk about is client-side validation versus server-side validation so a lot of you guys are going to be very lazy with this and you're going to implement the validations that i talked about in this video on either the server side or client side well actually let's be honest most of you are not going to implement any of these right but for the few of you who are you're going to implement either the client-side validations or the server-side validations so let me stop you right there you actually need to implement both of these you need to literally duplicate all of this logic and you need to do it in both the client side and the server side so let's talk about this first of all you want to have client-side validations so we can actually let the user's client or the browser do some of the work for us and that way we can alleviate some burden off of our servers right so let's say the user tries to upload a file and that file has the wrong extension let's just say right our client-side validation is going to detect that and it's going to cancel the upload right then and there right without actually sending a request to our server that means our server doesn't have to process that same file again right so this helps us to alleviate some of some of the burden off of our server while also making sure that we actually give faster responses to us to our users because we don't have to send that request to the server for processing right we can just give them the response right there in the client side but at the same time you need server side validations as well and the reason you need them is because the client side is vulnerable by default right the user can modify the client side and any malicious user can you know send malicious requests to a server from your client and your server needs to be able to detect these malicious requests with wrong data and be able to reject them appropriately so if the client side gets maliciously hacked or whatever and the user is sending a file with the wrong extension like some sort of an exe file that's a virus right your server needs to be able to detect that and reject the upload right then and there right so with that being said that is all i want to talk about today in this video if you just follow these seven little ideas that i have for you and you just make sure that you're implementing them in all of your all of your projects after this you're going to implement some really secure file upload systems and you're not going to have trouble with you know getting hacked over files and whatever unless you're doing something else that's stupid so just make sure that you are actually following all of these things and if you want to you can also re-watch this entire video take some notes and actually try to implement this in let's say a toy project of yours right like here's an idea how about you create a new project with a very simple back-end api right a very small back-end server and you implement file uploads in that server and then you actually go ahead and try out every single little tip that I gave you in this video and see how it would work in a real production setting right go do that and you're going to learn a ton of new things but that being said that's the end of this video thank you for watching like comment subscribe