Set metadata for the intended use
Use a media type that matches the actual content, not merely the filename extension supplied by a user. Incorrect types can cause confusing rendering or unsafe interpretation; validate uploads and avoid treating untrusted content as active markup.
Choose inline display or attachment behavior deliberately and use a safe filename. Account for how browsers handle international characters and special characters in filenames, and do not place unsanitized input into response headers.
Verify the response clients receive
Inspect the object’s metadata and the actual HTTP response headers through the same access path used by the application. A CDN or proxy may override stored metadata, so test the delivered response as well as the stored properties.
After changing metadata, check caching behavior and invalidate or version cached responses where needed. Validate representative file types in the target browsers or clients.