MIME Type Reference

What a MIME type is

MIME (Multipurpose Internet Mail Extensions) types are the standard way to identify the format and nature of a file. They are written as type/subtype and tell browsers and servers how to handle the content. You set them in the Content-Type header of an HTTP response and in attributes such as HTML's <input type="file" accept="...">.

Images (image)

Documents (application)

Text (text)

Audio (audio)

Video (video)

Archives and compression (application)

Fonts (font)

Other

Working with MIME types

Server configuration

A web server such as Apache or Nginx maps file extensions to MIME types. Get that mapping wrong and the browser cannot handle the file properly — a .webp without the right type, for instance, is offered as a download instead of being displayed as an image.

Validating uploads

When you build an upload feature, check the MIME type as well as the extension. The MIME type can still be forged on the client, though, so for security you should also verify the magic bytes at the start of the file.

The Content-Type header

Set an accurate Content-Type on API responses and file downloads: application/json for JSON, text/csv for CSV. When the encoding needs to be explicit, append a charset parameter, as in text/html; charset=utf-8.

Declaring MIME types in server configuration

Below are the snippets you reach for when serving modern formats — WebP, AVIF, WASM, web fonts — that are often missing from a server's default mapping.

Apache .htaccess

# Modern image formats
AddType image/webp .webp
AddType image/avif .avif
AddType image/svg+xml .svg .svgz

# Fonts — cache these aggressively
AddType font/woff  .woff
AddType font/woff2 .woff2

# WebAssembly and the modern JSON variants
AddType application/wasm        .wasm
AddType application/manifest+json .webmanifest
AddType application/ld+json     .jsonld

# Serve text as UTF-8
AddCharset utf-8 .html .css .js .json .xml

Nginx (overriding mime.types)

types {
    image/webp                webp;
    image/avif                avif;
    application/wasm          wasm;
    application/manifest+json webmanifest;
}

# Force a charset on text/* and application/json
charset utf-8;
charset_types text/css text/plain text/xml application/javascript application/json application/xml;

PHP — emitting Content-Type

// Download a PDF under a given filename
header('Content-Type: application/pdf');
header('Content-Disposition: attachment; filename="invoice.pdf"');
readfile($path);

// JSON API response — always state the charset
header('Content-Type: application/json; charset=utf-8');
echo json_encode($data, JSON_UNESCAPED_UNICODE);

Node.js / Express

// Express infers Content-Type from res.type() or the extension
app.get('/data.json', (req, res) => {
    res.type('application/json').send({ ok: true });
});

// Stream a file with an explicit MIME type
app.get('/report.csv', (req, res) => {
    res.set('Content-Type', 'text/csv; charset=utf-8');
    fs.createReadStream('report.csv').pipe(res);
});

Python — Flask / FastAPI

# Flask
from flask import Response
return Response(csv_text, mimetype='text/csv', headers={'Content-Disposition': 'attachment; filename="data.csv"'})

# FastAPI
from fastapi.responses import Response
return Response(content=json_str, media_type='application/json')

Go — net/http

w.Header().Set("Content-Type", "application/json; charset=utf-8")
w.Header().Set("X-Content-Type-Options", "nosniff")  // Security — see below
json.NewEncoder(w).Encode(data)

Security: why you need X-Content-Type-Options: nosniff

Browsers have historically sniffed the contents of a file to guess its type whenever the Content-Type header was missing or wrong. That is a known attack vector: if a file uploaded as image/jpeg is really HTML containing a <script> tag, the browser may sniff it as HTML and execute the script.

Send X-Content-Type-Options: nosniff on every response. It tells the browser to trust the Content-Type the server declared instead of guessing. It is essential for user-uploaded files and JSON APIs, where attackers try to get JSON reinterpreted as HTML or JavaScript.

Upload validation — the three-layer rule

1. Extension check — fast, but defeated by renaming the file. Treat it as a UX hint, nothing more.
2. The MIME type the client sends (the Content-Type inside the multipart boundary) — just as easy to forge. The browser derives it from the file extension anyway.
3. Magic-byte (file signature) detection — read the actual leading bytes and match them against the known signature (FF D8 FF for JPEG, 89 50 4E 47 for PNG). This is the only layer you can trust. See the magic byte reference for details.

The rule in production: do all three. Use the first two as cheap filters that reject obvious junk, and the third as the authoritative check.

Frequently asked questions