MIME Sniffing Standard MIME Sniffing Living Standard — Last Updated 17 July 2026 Participate: GitHub whatwg/mimesniff (new issue, open issues) Chat on Matrix Commits: GitHub whatwg/mimesniff/commits Snapshot as of this commit Tests: web-platform-tests mimesniff/ (ongoing work) Translations (non-normative): 日本語 简体中文 한국어 Abstract The MIME Sniffing standard defines sniffing resources. 1. Introduction The HTTP Content-Type header field is intended to indicate the MIME type of an HTTP response. However, many HTTP servers supply a Content-Type header field value that does not match the actual contents of the response. Historically, web browsers have tolerated these servers by examining the content of HTTP responses in addition to the Content-Type header field in order to determine the effective MIME type of the response. Without a clear specification for how to "sniff" the MIME type, each user agent has been forced to reverse-engineer the algorithms of other user agents in order to maintain interoperability. Inevitably, these efforts have not been entirely successful, resulting in divergent behaviors among user agents. In some cases, these divergent behaviors have had security implications, as a user agent could interpret an HTTP response as a different MIME type than the server intended. These security issues are most severe when an "honest" server allows potentially malicious users to upload their own files and then serves the contents of those files with a low-privilege MIME type. For example, if a server believes that the client will treat a contributed file as an image (and thus treat it as benign), but a user agent believes the content to be HTML (and thus privileged to execute any scripts contained therein), an attacker might be able to steal the user’s authentication credentials and mount other cross-site scripting attacks. (Malicious servers, of course, can specify an arbitrary MIME type in the Content-Type header field.) This document describes a content sniffing algorithm that carefully balances the compatibility needs of user agent with the security constraints imposed by existing web content. The algorithm originated from research conducted by Adam Barth, Juan Caballero, and Dawn Song, based on content sniffing algorithms present in popular user agents, an extensive database of existing web content, and metrics collected from implementations deployed to a sizable number of users. [SECCONTSNIFF] 2. Conformance requirements The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. For readability, these keywords will generally not appear in all uppercase letters. [KEYWORDS] Requirements phrased in the imperative as part of algorithms (such as "strip any leading space characters" or "return false and abort these steps") are to be interpreted with the meaning of the keyword used in introducing the algorithm. Conformance requirements phrased as algorithms or specific steps can be implemented in any manner, so long as the end result is equivalent. In particular, note that the algorithms defined in this specification are intended to be easy to understand and are not intended to be performant. 3. Terminology This specification depends on the Infra Standard. [INFRA] An HTTP token code point is U+0021 (!), U+0023 (#), U+0024 ($), U+0025 (%), U+0026 (&), U+0027 ('), U+002A (*), U+002B (+), U+002D (-), U+002E (.), U+005E (^), U+005F (_), U+0060 (`), U+007C (|), U+007E (~), or an ASCII alphanumeric. This matches the value space of the token token production. [HTTP-SEMANTICS] An HTTP quoted-string token code point is U+0009 TAB, a code point in the range U+0020 SPACE to U+007E (~), inclusive, or a code point in the range U+0080 through U+00FF (ÿ), inclusive. This matches the effective value space of the quoted-string token production. By definition it is a superset of the HTTP token code points. [HTTP-SEMANTICS] A binary data byte is a byte in the range 0x00 to 0x08 (NUL to BS), the byte 0x0B (VT), a byte in the range 0x0E to 0x1A (SO to SUB), or a byte in the range 0x1C to 0x1F (FS to US). A whitespace byte (abbreviated 0xWS) is any one of the following bytes: 0x09 (HT), 0x0A (LF), 0x0C (FF), 0x0D (CR), 0x20 (SP). A tag-terminating byte (abbreviated 0xTT) is any one of the following bytes: 0x20 (SP), 0x3E (">"). Equations are using the mathematical operators as defined in [ENCODING]. In addition, the bitwise NOT is represented by ~. 4. MIME types 4.1. MIME type representation A MIME type represents an internet media type as defined by Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types. It can also be referred to as a MIME type record. [MIMETYPE] Standards are encouraged to consistently use the term MIME type to avoid confusion with the use of media type as described in Media Queries. [MEDIAQUERIES] A MIME type’s type is a non-empty ASCII string. A MIME type’s subtype is a non-empty ASCII string. A MIME type’s parameters is an ordered map whose keys are ASCII strings and values are strings limited to HTTP quoted-string token code points. It is initially empty. 4.2. MIME type miscellaneous The essence of a MIME type mimeType is mimeType’s type, followed by U+002F (/), followed by mimeType’s subtype. A MIME type is supported by the user agent if the user agent has the capability to interpret a resource of that MIME type and present it to the user. Ideally this would be more precise. See w3c/preload #113. To minimize a supported MIME type given a MIME type mimeType, run these steps. They return an ASCII string. If mimeType is a JavaScript MIME type, then return "text/javascript". If mimeType is a JSON MIME type, then return "application/json". If mimeType’s essence is "image/svg+xml", then return "image/svg+xml". SVG is worth distinguishing from other XML MIME types. If mimeType is an XML MIME type, then return "application/xml". If mimeType is supported by the user agent, then return mimeType’s essence. Return the empty string. The goal of this algorithm is to allow the caller to distinguish MIME types with different processing models, such as those for GIF and PNG, but otherwise provide as little information as possible. 4.3. MIME type writing A valid MIME type string is a string that matches the media-type token production. In particular, a valid MIME type string may include parameters. [HTTP-SEMANTICS] A valid MIME type string is supposed to be used for conformance checkers only. "text/html" is a valid MIME type string. "text/html;" is not a valid MIME type string, though parse a MIME type returns a MIME type record for it identical to if the input had been "text/html". A valid MIME type string with no parameters is a valid MIME type string that does not contain U+003B (;). 4.4. Parsing a MIME type To parse a MIME type, given a string input, run these steps: Remove any leading and trailing HTTP whitespace from input. Let position be a position variable for input, initially pointing at the start of input. Let type be the result of collecting a sequence of code points that are not U+002F (/) from input, given position. If type is the empty string or does not solely contain HTTP token code points, then return failure. If position is past the end of input, then return failure. Advance position by 1. (This skips past U+002F (/).) Let subtype be the result of collecting a sequence of code points that are not U+003B (;) from input, given position. Remove any trailing HTTP whitespace from subtype. If subtype is the empty string or does not solely contain HTTP token code points, then return failure. Let mimeType be a new MIME type record whose type is type, in ASCII lowercase, and subtype is subtype, in ASCII lowercase. While position is not past the end of input: Advance position by 1. (This skips past U+003B (;).) Collect a sequence of code points that are HTTP whitespace from input given position. This is roughly equivalent to skip ASCII whitespace, except that HTTP whitespace is used rather than ASCII whitespace. Let parameterName be the result of collecting a sequence of code points that are not U+003B (;) or U+003D (=) from input, given position. Set parameterName to parameterName, in ASCII lowercase. If position is not past the end of input, then: If the code point at position within input is U+003B (;), then continue. Advance position by 1. (This skips past U+003D (=).) If position is past the end of input, then break. Let parameterValue be null. If the code point at position within input is U+0022 ("), then: Set parameterValue to the result of collecting an HTTP quoted string from input, given position and true. Collect a sequence of code points that are not U+003B (;) from input, given position. Given text/html;charset="shift_jis"iso-2022-jp you end up with text/html;charset=shift_jis. Otherwise: Set parameterValue to the result of collecting a sequence of code points that are not U+003B (;) from input, given position. Remove any trailing HTTP whitespace from parameterValue. If parameterValue is the empty string, then continue. If all of the following are true parameterName is not the empty string parameterName solely contains HTTP token code points parameterValue solely contains HTTP quoted-string token code points mimeType’s parameters[parameterName] does not exist then set mimeType’s parameters[parameterName] to parameterValue. Return mimeType. To parse a MIME type from bytes, given a byte sequence input, run these steps: Let string be input, isomorphic decoded. Return the result of parse a MIME type with string. 4.5. Serializing a MIME type To serialize a MIME type, given a MIME type mimeType, run these steps: Let serialization be the concatenation of mimeType’s type, U+002F (/), and mimeType’s subtype. For each name → value of mimeType’s parameters: Append U+003B (;) to serialization. Append name to serialization. Append U+003D (=) to serialization. If value does not solely contain HTTP token code points or value is the empty string, then: Precede each occurrence of U+0022 (") or U+005C (\) in value with U+005C (\). Prepend U+0022 (") to value. Append U+0022 (") to value. Append value to serialization. Return serialization. To serialize a MIME type to bytes, given a MIME type mimeType, run these steps: Let stringSerialization be the result of serialize a MIME type with mimeType. Return stringSerialization, isomorphic encoded. 4.6. MIME type groups An image MIME type is a MIME type whose type is "image". An audio or video MIME type is any MIME type whose type is "audio" or "video", or whose essence is "application/ogg". A font MIME type is any MIME type whose type is "font", or whose essence is one of the following: [RFC8081] application/font-cff application/font-otf application/font-sfnt application/font-ttf application/font-woff application/vnd.ms-fontobject application/vnd.ms-opentype A ZIP-based MIME type is any MIME type whose subtype ends in "+zip" or whose essence is one of the following: application/zip An archive MIME type is any MIME type whose essence is one of the following: application/x-rar-compressed application/zip application/x-gzip An XML MIME type is any MIME type whose subtype ends in "+xml" or whose essence is "text/xml" or "application/xml". [RFC7303] An HTML MIME type is any MIME type whose essence is "text/html". A scriptable MIME type is an XML MIME type, HTML MIME type, or any MIME type whose essence is "application/pdf". A JavaScript MIME type is any MIME type whose essence is one of the following: application/ecmascript application/javascript application/x-ecmascript application/x-javascript text/ecmascript text/javascript text/javascript1.0 text/javascript1.1 text/javascript1.2 text/javascript1.3 text/javascript1.4 text/javascript1.5 text/jscript text/livescript text/x-ecmascript text/x-javascript A string is a JavaScript MIM…