In order to validate allowed mime types in file uploads I usually rely on the fileinfo extension but since that extension or the magic database isn’t always available I though of using the type index associated with each file on the $_FILES superglobal.
So my question is, where does this index come from? I suspect it either comes from the browser (and if that’s the case it can be forged) or, most likely, from the web server (or PHP) – and if this is the case: is it just an extension to mime type mapping or is it the real thing?
It’s the MIME type of the file supplied by the browser through interpreting the extension of the file. So you’re right, this can be forged by the client.