title: Image download mime type validation python requests
body: <p>I use the requests library in python to download a large number of image files via http. I convert the received content to raw bytes using BytesIO in python and then use Pillow() to save this raw content as a jpeg file.</p>
  
  <pre><code>from PIL import Image
  from io import BytesIO
  
  rsp = requests.get(imageurl)
  content_type_received = rsp.headers['Content-Type'] # mime type
  binarycontent = BytesIO(rsp.content)
  if content_type_received.startswith('image'): # image/jpeg, image/png etc
      i = Image.open(binarycontent)
      outfilename = os.path.join(outfolder,'myimg'+'.jpg')
      with open(outfilename, 'wb') as f:
          f.write(rsp.content)
      rsp.close()
  </code></pre>
  
  <p>What is the potential security risk of this code? (I am not sure how much we can trust the server saying mime type in the response header is really what the server says it is?) Is there a better way to write a secure download routine?</p>