File Signatures (Magic Bytes)
Extension spoofing (`virus.exe` → `photo.jpg`) and MIME spoofing are common attack vectors. Magic-byte detection is the first line of defense in upload validation, antivirus, and content sniffing.
What It Defines
Recognizable byte sequences at the start (or end, for formats like ZIP) of a file that identify its true format independent of filename or declared MIME type. Examples: PNG `89 50 4E 47`, PDF `%PDF`, ZIP `PK\x03\x04`, JPEG `FF D8 FF`. Secure systems sniff magic bytes and parse structure — they do not trust extensions or Content-Type alone.
Canonical (Normative)
Convenient (Practical)
Related References
Authoritative registry for protocol parameters: ports, HTTP status codes, media types, DNS record types, and many other code points. Not a spec body — a registry body.
Related Specs
Every upload, download, attachment, and asset pipeline crosses these layers. Misunderstanding header vs envelope causes MIME spoofing bugs, parser differentials, and broken file validation. Start here before diving into individual format specs.
Correct Content-Type headers drive content negotiation, browser rendering, and API behavior. Wrong types cause security and parsing bugs.
PNG is the default lossless image format on the web — screenshots, UI assets, icons with transparency, and OCR-friendly graphics. Chunk structure matters for metadata stripping and security review.
JPEG dominates photo storage and delivery. EXIF metadata (GPS, camera, orientation) lives in APP1 markers — relevant for privacy, image processing, and upload pipelines.
PDF is the standard for invoices, reports, contracts, and printable documents. Object/stream structure, encryption, and embedded content matter for parsing, redaction, and security review.
ZIP is everywhere — downloads, backups, Java JARs, Office Open XML. Central-directory-at-end structure, path traversal (`../../`), and zip bombs are critical security concerns.