Laravel's getClientMimeType() offers no upload security; two safer alternatives explained

A common Laravel file upload mistake involves using getClientMimeType() to validate uploads, which reads a browser-supplied HTTP header that attackers can freely manipulate. A renamed PHP file with a spoofed image/jpeg header will pass this check without issue. Laravel's built-in validation rules — mimes: and mimetypes: — are both safe alternatives because they inspect the actual file contents on disk rather than the client-provided header. The two rules differ slightly: mimes: maps detected MIME types back through an extension lookup, while mimetypes: compares the detected type directly, making it the more precise option. Using both rules together is recommended, as Laravel also applies a secondary check that rejects files with PHP-related extensions regardless of what content sniffing reports.