You should do a check on file.getContentType() if it matches "image/jpeg" or "image/png". Not sure if consumes property of the @PostMapping would work because the request is of type "multipart/form-data" or "application/x-www-form-urlencoded" it seems.