MIME types vs file extensions: set Content-Type deliberately

A name is not the content

A filename extension suggests a format but can be renamed freely. Content-Type describes how the sender intends the receiver to interpret the representation.

Use MIME Lookup for common mappings, then verify the file or response bytes. Extension-based lookup alone is not reliable upload validation.

document.json → commonly application/json
photo.png     → commonly image/png

Choose the API representation

A JSON body should use an appropriate JSON media type; HTML and plain text need different types. A misleading type can cause parsing or browser behavior problems.

Confirm the response body as well as the header. An endpoint can return an HTML error page while a client expected JSON.

Type and disposition are separate

Content-Disposition influences whether a response is presented inline or downloaded and can provide a suggested filename. It is not a substitute for an accurate Content-Type.

Set filename handling according to the application, and consider nosniff to prevent browsers from guessing executable types from mismatched content.

Validate at the application boundary

For uploads, combine format-aware decoding, limits and allowed types. A magic-byte check alone may still be insufficient for complex or polyglot content.

Nav Tools lookup reports conventional types rather than certifying a file as safe. Test the consuming browser or parser with the intended representation.