IANA Standards · Server Snippets · Security Best Practices

MIME Type Lookup & Content-Type Directory

Identify the official IANA media type for any file extension. Copy exact Content-Type headers, Nginx server directives, and Express.js response snippets.

Found 62 typesClick any entry to view headers & server configuration snippets

.json

application

JavaScript Object Notation (REST APIs, configs)

MIME Content-Type

application/json

Gzip / Brotli

Recommended (Compressible)

MIME Sniffing Risk

Protected by nosniff

Server Response Header Snippets

HTTP Response Headers

Content-Type: application/json
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=31536000, immutable

Node.js / Express

res.setHeader('Content-Type', 'application/json');
res.setHeader('X-Content-Type-Options', 'nosniff');

Nginx types {} Directive

types {
    application/json  json;
}

Web Security, MIME Sniffing & Content-Type Guide

01.What is MIME Sniffing & Why It Is Dangerous

When a web server returns a file without an explicit Content-Type or with a generic type, browsers historically attempted to "sniff" (guess) the format by inspecting the initial bytes of the body.

This creates severe Cross-Site Scripting (XSS) vulnerabilities. For example, if an attacker uploads a malicious image containing disguised JavaScript code and the browser sniffs it as text/html, the script executes within the victim's origin session. Always send:

X-Content-Type-Options: nosniff

02.Modern Web Media: AVIF, WebP & WOFF2

Modern web assets achieve dramatically smaller payload sizes, but only if web servers declare their standard MIME types:

image/avif: The AV1 image container achieves 20% to 50% better compression than WebP and JPEG. Requires explicit web server configuration on older Linux distributions.
image/webp: Universal across all modern browsers. Delivers both lossy and lossless transparent compression.
font/woff2: Pre-compressed using the Brotli algorithm. Web servers should never attempt to gzip or re-compress .woff2 files, as this wastes CPU cycles without size reductions.

03.The application/octet-stream Fallback

The MIME type application/octet-stream indicates arbitrary binary data.

Browsers handle octet-stream responses by prompting the user to download the file rather than displaying it inline. When forcing a download, combine it with the Content-Disposition header:

Content-Disposition: attachment; filename="report.pdf"

04.Specifying Character Encodings (charset=utf-8)

For text and document resources (text/html, text/plain, text/css, and text/csv), always specify the character set:

Content-Type: text/html; charset=utf-8

Omitting the charset parameter can cause browsers to misinterpret unicode characters, resulting in mojibake (scrambled glyphs) or security issues.