What’s the safest way to validate uploaded images in FastAPI?

Pillow is commonly used for this check. Open the upload with it and run an integrity check, then confirm that the detected format is one of your allowed formats. You should also consider decoding and re-encoding the image before storage if you want to discard unusual metadata or embedded content. Avoid accepting SVG unless you have a specific sanitization strategy, since it can contain active content.

Set a strict maximum upload size and enforce it while the request is being received. Don’t wait until the entire body is in memory or storage; stop the upload once it exceeds the limit, ideally with a small allowance for request overhead. Limiting dimensions and processing time is also useful for preventing decompression-bomb-style images.

Treat the request Content-Type as an initial filter, not as proof that the file is safe—the client can set it to anything. After that, validate the file signature and restrict uploads to formats you explicitly support, such as JPEG, PNG, and WebP. An image-processing library such as Pillow can then open and verify the file rather than relying only on the first few bytes. Reject anything that fails validation with a bad-request response.

The important distinction is that object storage does not make an untrusted file valid. Keep uploads isolated, use generated filenames rather than user-supplied paths, serve them with safe content-disposition and content-type headers, and never render them as executable content. MIME headers and magic-number checks are useful layers, but successful decoding by a trusted image library is a stronger format check.