in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html
or .htm file types.
For any security checks that are performed on the client side, ensure that these checks
are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass