custom mail-form security

[curious]

theres a contact form on my J3.6.2 site with uploading attachment functionality. i need to know what to do to make this overall "secure".
using Jinput /Jfile/addAttachment.


1.)the Attachment/UPLOAD:

$Input = JFactory::getApplication()->input;
$File = $Input->files->get('Asset');

if ($File) {$Mailer->addAttachment($File["tmp_name"], $File['name'], "base64", $File['type']);}

is there some automatic check against allowed filetype by default (media-settings) or should there be something implemented by myself? ..checking mime type, filesize, etc

the formfield:

<input id="assets" name="Asset" type="file" value="" class="form-control" required>


2.)I read about session token
https://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms

how important is this in terms of security? for a simple contact form using onboard phpmailer...its not a component form with tasks or DB write..