(I'm assuming you're doing the above for security) It's hard to make a call what you should do without being more specific about the app, especially (i) purpos

(I'm assuming you're doing the above for security) It's hard to make a call what you should do without being more specific about the app, especially (i) purpose of the uploads e.g. image sharing can probably be restrictive, and (ii) level of trust - public vs intranet, sharing with known people vs strangers, etc. Regardless, if you want to go liberal (option #1), I'd use the following logic: 1. serve all files so that the browser will save the file instead of opening it 2. optional: have a whitelist of exceptions to the above e.g. images 3. optional: block (or fix) executables e.g. .exe, .vbs etc which the user could still run after download