If you were creating the header on the upload request programmatically, you can declare the headers, etc. An explanation which includes some code samples.
You should go beyond the mime type and check the content. E.g., if you allow an image upload, do a conversion of the image on the server and do other checks as well.
You may want to check out this post on SO:
The "signature headers" help you to decide what kind of image format a
file tries to impersonate. In a next step you could check if the rest
of the contents are compliant with the underlying image format. This
would guarantee you that the file is really an image file of that
You may also be interested in this article on GIFAR:
They call this type of file a GIFAR, a contraction of GIF and JAR, the
two file types that are mixed. At Black Hat, the researchers will show
attendees how to create the GIFAR while omitting a few key details to
prevent it from being used immediately in any widespread attack.
To the Web server, the file looks exactly like a .gif file, however a
browser's Java virtual machine will open it up as a Java Archive file
and then run it as an applet. That gives the attacker an opportunity
to run Java code in the victim's browser. For its part, the browser
treats this malicious applet as though it were written by the Web