MIME Types Reference

What is a MIME type?

MIME (Multipurpose Internet Mail Extensions) types are a standard mechanism for identifying file format and nature. Written as type/subtype, they tell browsers and servers how to process a file. Used in HTTP Content-Type headers, HTML <input type="file" accept="..."> attributes, and elsewhere.

Image (image/*)

Documents (application/*)

Text (text/*)

Audio (audio/*)

Video (video/*)

Archives & Compression (application/*)

Fonts (font/*)

Other

Using MIME types in development

Server-side configuration

Web servers (Apache / Nginx) map file extensions to MIME types. If misconfigured, browsers may fail to handle the file correctly — for example, a .webp file with the wrong MIME type may be downloaded instead of displayed inline.

Upload validation

When implementing file uploads, validate both extension and MIME type. Be aware that MIME types can be spoofed by the client, so combine them with magic-byte (file signature) validation for security.

Content-Type header

Set an appropriate Content-Type header on API responses and downloads. Use application/json for JSON, text/csv for CSV, and add a charset parameter (text/html; charset=utf-8) when needed.

Setting MIME types in server configs

Below are the configuration snippets you reach for 90% of the time when serving modern formats (WebP, AVIF, WASM, font files) that may not be in your server's default mapping.

Apache .htaccess

# Modern image formats
AddType image/webp .webp
AddType image/avif .avif
AddType image/svg+xml .svg .svgz

# Fonts (so the browser caches them aggressively)
AddType font/woff  .woff
AddType font/woff2 .woff2

# WebAssembly & modern JSON variants
AddType application/wasm        .wasm
AddType application/manifest+json .webmanifest
AddType application/ld+json     .jsonld

# Force UTF-8 for text formats
AddCharset utf-8 .html .css .js .json .xml

Nginx (mime.types overrides)

types {
    image/webp                webp;
    image/avif                avif;
    application/wasm          wasm;
    application/manifest+json webmanifest;
}

# Force charset for text/* and application/json
charset utf-8;
charset_types text/css text/plain text/xml application/javascript application/json application/xml;

PHP — sending Content-Type

// Serve a download with the right Content-Type and a filename
header('Content-Type: application/pdf');
header('Content-Disposition: attachment; filename="invoice.pdf"');
readfile($path);

// JSON API response (always include charset)
header('Content-Type: application/json; charset=utf-8');
echo json_encode($data, JSON_UNESCAPED_UNICODE);

Node.js / Express

// Express infers Content-Type from res.type() or the file extension
app.get('/data.json', (req, res) => {
    res.type('application/json').send({ ok: true });
});

// Streaming a file with explicit MIME
app.get('/report.csv', (req, res) => {
    res.set('Content-Type', 'text/csv; charset=utf-8');
    fs.createReadStream('report.csv').pipe(res);
});

Python — Flask / FastAPI

# Flask
from flask import Response
return Response(csv_text, mimetype='text/csv', headers={'Content-Disposition': 'attachment; filename="data.csv"'})

# FastAPI
from fastapi.responses import Response
return Response(content=json_str, media_type='application/json')

Go — net/http

w.Header().Set("Content-Type", "application/json; charset=utf-8")
w.Header().Set("X-Content-Type-Options", "nosniff")  // security: see below
json.NewEncoder(w).Encode(data)

Security: why X-Content-Type-Options: nosniff matters

Browsers historically "sniffed" file contents to guess the type when the Content-Type header was missing or wrong. This is a known attack vector — a user uploading a file labeled image/jpeg that actually contains <script> could trigger XSS if the browser sniffs it as HTML.

Always send X-Content-Type-Options: nosniff on every response. It tells the browser "trust the Content-Type I sent; do not guess." This is especially critical for user-uploaded content and JSON APIs (where a hostile attacker could try to coerce JSON into being interpreted as HTML or JS).

Upload validation — the 3-layer rule

1. Extension check — fast, but easily bypassed by renaming files. Use as a UX hint only.
2. Client-sent MIME type (the Content-Type in the multipart boundary) — equally easy to spoof; the browser sets it based on the file's extension.
3. Magic bytes (file signature) detection — reads the first few bytes of the actual file content and compares against known signatures (e.g., FF D8 FF for JPEG, 89 50 4E 47 for PNG). This is the only reliable layer. See the Magic Bytes reference for the full table.

Production rule of thumb: do all three. Treat the first two as quick filters that reject obvious garbage; treat the third as the authoritative check.

Frequently asked questions