Running the same validation again on the server is the part many import tools skip, and it matters because the client side mapping can always be bypassed. Two cases worth testing are files saved from Excel with a BOM on the first header, and semicolon delimiters from European locales, since both silently break header matching. Showing the user a per-row error report they can download and fix also beats rejecting the whole file.