Allowing Files Without Names or Extensions

Some sources upload files without a filename or extension — a curl POST with raw bytes, a webhook delivering a screenshot, a sensor pushing telemetry. By default ActiveManage rejects these. This article shows when and how to relax that.

Why It's Off by Default

• Anonymous bytes are a common attack vector — uploaders rely on filename to guess type, and extensionless files bypass that.
• Browsers cannot identify what to do with extensionless downloads — they prompt the user, which is confusing.
• The MIME-type sniff catches most well-formed files but not all.

When to Allow

• API uploads with explicit type header: Caller sends Content-Type: image/png and raw bytes — trust the header for typed callers (your own services).
• Programmatic webhook: Vendor's webhook sends data plus a separate metadata field with the original filename.
• Sensor / IoT data: Binary blobs from a fleet of devices; the caller is implicitly trusted.

How to Allow

1. Open Site Settings → Files → Upload Rules.
2. Toggle Allow uploads with no filename/extension on.
3. Pick what to do:
   • Auto-generate filename as UUID, with extension inferred from MIME type (if detectable).
   • Reject uploads where MIME detection also fails.
4. Optionally limit this allowance to specific upload endpoints (e.g. API only, not web form).

Worked Examples

• Telemetry endpoint: Sensors upload raw binary; the API receiver auto-names them {uuid}.bin and tags with sensor ID.
• Webhook image relay: Vendor sends image/png in body; saved as {uuid}.png.
• Internal upload script: Operations team scripts upload anonymous files via API; rule allowed only for that API key's scope.