title: How to restrict/validate file upload filetypes server side on IIS
body: <p>I would like to have a whitelist of filetypes that users are authorized to upload to my IIS server (im using IIS v7.5).</p>
  
  <p>What is the options that i have? For example, to restrict filesize to 5MB for a specific action in my controller, i added this section to my webconfig:</p>
  
  <pre><code>&lt;location path="home/fileupload"&gt;
    &lt;system.web&gt;
      &lt;!-- maxRequestLength is in kilobytes (KB) --&gt;
      &lt;httpRuntime maxRequestLength="5120" /&gt; &lt;!-- 5MB --&gt;
    &lt;/system.web&gt;
    &lt;system.webServer&gt;
      &lt;security&gt;
        &lt;requestFiltering&gt;
          &lt;!-- maxAllowedContentLength is in bytes --&gt;
          &lt;requestLimits maxAllowedContentLength="5242880"/&gt; &lt;!-- 5MB --&gt;
        &lt;/requestFiltering&gt;
      &lt;/security&gt;
    &lt;/system.webServer&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>Is there an option in the webconfig to set a whitelist of allowed filetypes? Or is the only option is to validate the filetypes in code when the file is fully uploaded? What is the recommended technics? How can i be sure that the .docx, .pdf, .jpg, etc are really what they are?</p>