{
  "id": 17780480,
  "title": "Serving Customer-Sent WhatsApp Media Safely: MIME Types, Filenames and the Blob URL Trap",
  "url": "https://urgent.news/2026/11/02/serving-customer-sent-whatsapp-media-safely-mime-types-filenames-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T10:22:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/wapgrowai/serving-customer-sent-whatsapp-media-safely-mime-types-filenames-and-the-blob-url-trap-5egm"
  },
  "original_language": "en",
  "account": "WhatsApp's customer service inbox displays files from unknown sources within a logged-in browser tab. This includes photos, voice notes, PDFs, and various documents. Agents open these files in the same browser tab that grants them access to all account conversations. If served incorrectly, a file can become executable code running under that agent's control. The focus of this article is on safely handling inbound WhatsApp media messages, determining what to trust, storage methods, and the necessary response headers for secure serving. The provided TypeScript snippets illustrate practical implementations of the discussed concepts, based on actual test cases.",
  "summary": "A WhatsApp team inbox does something most web apps avoid: it shows files from strangers inside a logged-in session. Customers send photos, voice notes, PDFs and \"documents\" of any kind, and an agent opens them in the same browser tab that holds their access to every conversation in the account. If one of those files is served back the wrong way, it stops being a picture and becomes code running…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}