Prevent multi upload with users

No my problem is not file type or content
My problem is only upload file from app and prevent upload file with username and password with restful tools or php
I try prevent with useragent or api key special for mobile but it is not necessary

CSRF is not for file type, it's for making sure the incoming requests originate from server in the first place.

There's more stuff on it here:
https://www.owasp.org/index.php/Cross-Si...heat_Sheet

Yes i know but it is good in web
When user open forms,during open form,we add token into form body and codeigniter check it when we post it
But in application there is no form and i have to get token before upload file that i think it is bad,isn't it?