Does the file type check look at the client's Content-Type or at the file's content?

Short answer

It looks at the file's content. The Content-Type header of the multipart part is read but is not used in the Allowed Upload Mime Types inspection; the type is detected from the signatures in the first bytes of the file (PDF, images, archives, Office documents). If there is no known signature and the content contains binary control characters, the type becomes application/octet-stream; in text content, HTML, XML, SVG, PHP and script headers are searched for; if the type still does not come out, the file name extension is looked at, and if the extension is not recognized, text/plain is returned. The extension is also used to distinguish the type of ZIP and old Office-based documents. For this reason, a PHP script cannot be uploaded by setting the Content-Type to image/png; a file with a .txt extension but containing <?php is detected as application/x-httpd-php. In raw bodies, the same detection is done without the file name (Allowed Raw Body Mime Types).

How Does It Work?

#	Step	Example result
1	Signatures in the first bytes of the file	application/pdf, image/png, image/jpeg, application/zip; in ZIP and old Office formats, distinction by the extension (e.g. .docx → application/msword, .xlsx → application/vnd.ms-excel)
2	No signature, the content contains a binary control character	application/octet-stream
3	Header search in text content	text/html, application/xml, image/svg+xml, application/x-httpd-php, text/x-shellscript
4	File name extension	The known type of the extension (e.g. .txt → text/plain)
5	None	text/plain

• The detected type is seen in the Description field of the violation record; the allow list is written with this name (Can I allow only certain MIME types in file uploads?).
• If only one of the filename and Content-Type headers is present in the multipart part, or if the file name is empty (filename="", a file field left empty by the browser) or not in quotes, the body cannot be parsed; in this case, the Block Invalid Form Contents setting comes into play (Can I block malformed (unparseable) JSON / XML / form bodies?).
• A file that starts with an image signature is detected as the image type even if it carries other content inside it; the scanning of the file content for attack patterns is done with OWASP Check in Upload (Is the content of uploaded files scanned as well (OWASP Check in Upload)?).

Common Misconceptions

• "Changing the Content-Type passes the type inspection." The type declared by the client is not used in the inspection; the type is detected from the content.
• "The extension is never taken into account." The extension is used in the last step for texts whose type does not come out of the content, and in distinguishing ZIP and old Office-based documents.
• "The detected name is always the official MIME name." Some documents are detected with a general name (e.g. .docx → application/msword); the list is completed with the detected name seen in the record.

How it is done in the documentation

• Form · Allowed Upload Mime Types
• Raw · Allowed Raw Body Mime Types
• Form · What Is Form?

Related questions

• Can I allow only certain MIME types in file uploads?
• What is Allowed Raw Body Mime Types used for?
• File uploads are being blocked by the WAF; how do I fix it?