{"record":{"id":"844d8bef1f0be332","repo":"zitadel/zitadel","slug":"invalid-content-type-s","errorCode":null,"errorMessage":"invalid content-type: %s","messagePattern":"invalid content-type: (.+?)","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"internal/api/assets/asset.go","lineNumber":176,"sourceCode":"\t\tdefer func() {\n\t\t\terr = file.Close()\n\t\t\tlogging.OnError(err).Warn(\"could not close file\")\n\t\t}()\n\n\t\tmimeType, err := mimetype.DetectReader(file)\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\t_, err = file.Seek(0, io.SeekStart)\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\n\t\tsize := handler.Size\n\t\tif !uploader.ContentTypeAllowed(mimeType.String()) {\n\t\t\ts.ErrorHandler()(w, r, fmt.Errorf(\"invalid content-type: %s\", mimeType), http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tif size > uploader.MaxFileSize() {\n\t\t\ts.ErrorHandler()(w, r, fmt.Errorf(\"file too big, max file size is %vKB\", uploader.MaxFileSize()/1024), http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\n\t\tresourceOwner := uploader.ResourceOwner(authz.GetInstance(ctx), ctxData)\n\t\tobjectName, err := uploader.ObjectName(ctxData)\n\t\tif err != nil {\n\t\t\ts.ErrorHandler()(w, r, fmt.Errorf(\"upload failed: %v\", err), http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tuploadInfo := &command.AssetUpload{\n\t\t\tResourceOwner: resourceOwner,\n\t\t\tObjectName:    objectName,\n\t\t\tContentType:   mimeType.String(),\n\t\t\tObjectType:    uploader.ObjectType(),","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/zitadel/zitadel/blob/13948f2bcd6f257794dbd6d342c2ac30bc88fe54/internal/api/assets/asset.go#L158-L194","documentation":"The asset upload handler sniffs the uploaded file's MIME type and checks it against the uploader's allowed content types (ContentTypeAllowed). If the detected type is not allowed, the request is rejected with 400 'invalid content-type'.","triggerScenarios":"Uploading an asset (logo, icon, user avatar via /assets/v1 endpoints) whose detected MIME type is not in the uploader's allowed list, e.g. uploading an SVG to an endpoint that only accepts PNG/JPEG, or sending a text file where an image is required.","commonSituations":"Uploading files with wrong extensions after renaming; brand logos supplied as SVG when the endpoint only permits raster images; API clients sending JSON instead of multipart file data so the sniffed type is wrong.","solutions":["Upload a file whose MIME type matches the endpoint's allowed list (e.g. PNG/JPEG for logos)","Send a proper multipart/form-data request with the file part","Check the specific uploader's allowed content types (e.g. internal/api/assets) and convert/serve the asset accordingly"],"exampleFix":"// before\ncurl -F \"file=logo.svg\" $HOST/assets/v1/instance\n// after\nconvert logo.svg logo.png\ncurl -F \"file=@logo.png\" $HOST/assets/v1/instance","handlingStrategy":"validation","validationCode":"const allowed = [\"image/png\", \"image/jpeg\", \"image/webp\"];\nconst file = formData.get(\"file\");\nif (!allowed.includes(file.type)) throw new Error(`content-type ${file.type} not allowed; use one of ${allowed.join(\", \")}`);","typeGuard":"function isAllowedMime(t, allowed) { return allowed.includes(t); }","tryCatchPattern":"try {\n  await uploadAsset(file);\n} catch (e) {\n  if (e.status === 400 && e.message.includes(\"invalid content-type\")) {\n    // convert the file to an allowed type and retry once\n  }\n}","preventionTips":["Check the endpoint's allowed content types before integrating uploads","Convert SVGs to PNG/JPEG client-side for logo endpoints","Send real multipart file parts, not raw JSON bodies, so server-side sniffing sees the right type"],"tags":["http","assets","content-type"],"backgroundTag":"invalid-config-value","analyzedSha":"13948f2bcd6f257794dbd6d342c2ac30bc88fe54","analyzedAt":"2026-09-06T10:16:19.814Z","contentChangedAt":"2026-09-06T10:16:19.814Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}