MIME

web devIT support

Stands for: Multipurpose Internet Mail Extensions

A standard for labeling the type of a piece of content.

Multipurpose Internet Mail Extensions (RFC 2045) defined content types like `text/html` and `application/json`, originally for email attachments and now the media-type system the whole web uses to say what a byte stream is.

MIME extended mail beyond plain ASCII text, adding character sets, attachments and multipart messages. The media types it defined outlived their origin entirely and are now how the whole web labels content.

The security consequence is content sniffing. When a declared type and actual content disagree, a browser historically guessed, and a guess that turns an uploaded image into executable script is a vulnerability. That is why the nosniff header exists and why serving user-uploaded content from a separate origin with a correct declared type is standard practice. The type declaration is a security control, not merely a hint about how to display something.

Also known as: mime

← All glossary entries