Secure File Storage & Upload Pipeline Hardening

Schools routinely upload sensitive digital assets: student birth certificates, national examination scorecards, teacher degree certifications, and profile photos. Naive file upload architectures can expose these documents to unauthorized public downloads or stored Cross-Site Scripting (XSS). This guide details YeneSchool's hardened file processing and delivery pipeline.

1. Multi-Layer File Validation on Ingestion

When a file is submitted via /api/uploads:

1. Magic Bytes & MIME Sniffing: The server inspects the binary file headers (magic bytes) rather than trusting client-provided file extensions or Content-Type headers. Files disguised as .png or .pdf but containing executable scripts or HTML payloads are instantly rejected.
2. Strict Extension Whitelist:
   • Images: .jpg, .jpeg, .png, .webp (SVG uploads are strictly disallowed in user-facing profiles to prevent stored SVG-XSS attacks).
   • Documents: .pdf, .docx, .xlsx, .csv.
3. File Size Ceilings:
   • Profile Avatars: Maximum 2 MB.
   • Student Admission Scans & PDFs: Maximum 10 MB.
   • Bulk CSV Import Files: Maximum 5 MB.
4. Anti-Path Traversal Sanitization: Filenames are stripped of directory traversal characters (../, ..\) and replaced with high-entropy UUIDs.

2. Unguessable File Paths & Storage Layout

Files are organized in isolated directory structures on persistent storage:

/uploads/
  └── <school-unique-cuid>/
        ├── avatars/
        │     └── 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d.webp
        ├── documents/
        │     └── 550e8400-e29b-41d4-a716-446655440000.pdf
        └── report-cards/
              └── c20ad412-2c6e-47c3-bf6b-731383569726.pdf

• Directories use tenant unique CUIDs, preventing cross-tenant path collisions.
• Files use random UUIDv4 names, making URL guessing or sequential brute-forcing computationally impossible.

3. Authenticated Streaming vs Public Static Assets

In production:

• Sensitive institutional files (student certificates, report cards, fee receipts) are never served directly via public static web servers.
• Downloads must pass through the authenticated streaming controller (/api/documents/download/:id), which validates the caller's JWT token and verifies their role and branch association before piping the file stream.
• The server sends Content-Disposition: attachment and X-Content-Type-Options: nosniff headers to prevent browsers from executing uploaded content.