449

I have to validate the Content-Type header value before passing it to an HTTP request.

Is there a specific list for all the possible values of Content-Type?

Otherwise, is there a way to validate the content type before using it in an HTTP request?

Matthias Braun
  • 32,039
  • 22
  • 142
  • 171
Awesome
  • 5,689
  • 8
  • 33
  • 58
  • 20
    Valid media types are supposed to be registered with the IANA - you can see a current list here: http://www.iana.org/assignments/media-types/media-types.xhtml but note this list can update over time. There is not a fixed allowed list. – Joe May 17 '14 at 17:56
  • 1
    Related post - [ASP MVC - Are there any constants for the default content types?](https://stackoverflow.com/q/10362140/465053) – RBT Aug 07 '18 at 12:21
  • @Joe: "Valid media types are supposed to be registered with the IANA" - wait, does this mean custom media types (only for use in an application-specific web API that is only going to be called by a custom client application) are not permitted at all? – O. R. Mapper Nov 05 '18 at 06:52
  • 2
    @O.R.Mapper i'd read it more as "there is an official list, but i would not be surprised to see lots of others in the wild". In terms of the OP's question, if you were going to try and validate "all types" you'd at least want to validate all registered types. What to do with additional ones is more open-ended. As far as I know there is no *requirement* to register custom types. – Joe Nov 05 '18 at 16:07
  • Please accept the answer which helped you most in solving your problem. It helps future readers. If the answers weren't helpful leave comments below them. So the poster can update them accordingly. Read [_What should I do when someone answers my question?_](https://stackoverflow.com/help/someone-answers) to know more. – Roshana Pitigala Sep 04 '19 at 13:39

4 Answers4

524

You can find every content types here: http://www.iana.org/assignments/media-types/media-types.xhtml

The most common types are:

  1. Type application:

     application/java-archive
     application/EDI-X12   
     application/EDIFACT   
     application/javascript   
     application/octet-stream   
     application/ogg   
     application/pdf  
     application/xhtml+xml   
     application/x-shockwave-flash    
     application/json  
     application/ld+json  
     application/xml   
     application/zip  
     application/x-www-form-urlencoded  
    
  2. Type audio:

     audio/mpeg   
     audio/x-ms-wma   
     audio/vnd.rn-realaudio   
     audio/x-wav   
    
  3. Type image:

     image/gif   
     image/jpeg   
     image/png   
     image/tiff    
     image/vnd.microsoft.icon    
     image/x-icon   
     image/vnd.djvu   
     image/svg+xml    
    
  4. Type multipart:

     multipart/mixed    
     multipart/alternative   
     multipart/related (using by MHTML (HTML mail).)  
     multipart/form-data  
    
  5. Type text:

     text/css    
     text/csv    
     text/html    
     text/javascript (obsolete)    
     text/plain    
     text/xml    
    
  6. Type video:

     video/mpeg    
     video/mp4    
     video/quicktime    
     video/x-ms-wmv    
     video/x-msvideo    
     video/x-flv   
     video/webm   
    
  7. Type vnd:

     application/vnd.android.package-archive
     application/vnd.oasis.opendocument.text    
     application/vnd.oasis.opendocument.spreadsheet  
     application/vnd.oasis.opendocument.presentation   
     application/vnd.oasis.opendocument.graphics   
     application/vnd.ms-excel    
     application/vnd.openxmlformats-officedocument.spreadsheetml.sheet   
     application/vnd.ms-powerpoint    
     application/vnd.openxmlformats-officedocument.presentationml.presentation    
     application/msword   
     application/vnd.openxmlformats-officedocument.wordprocessingml.document   
     application/vnd.mozilla.xul+xml   
    
Habie Smart
  • 139
  • 1
  • 9
lebarillier
  • 5,294
  • 1
  • 9
  • 14
54

As is defined in RFC 1341:

In the Extended BNF notation of RFC 822, a Content-Type header field value is defined as follows:

Content-Type := type "/" subtype *[";" parameter]

type := "application" / "audio" / "image" / "message" / "multipart" / "text" / "video" / x-token

x-token := < The two characters "X-" followed, with no intervening white space, by any token >

subtype := token

parameter := attribute "=" value

attribute := token

value := token / quoted-string

token := 1*<any CHAR except SPACE, CTLs, or tspecials>

tspecials := "(" / ")" / "<" / ">" / "@" ; Must be in / "," / ";" / ":" / "" / <"> ; quoted-string, / "/" / "[" / "]" / "?" / "." ; to use within / "=" ; parameter values

And a list of known MIME types that can follow it (or, as Joe remarks, the IANA source).

As you can see the list is way too big for you to validate against all of them. What you can do is validate against the general format and the type attribute to make sure that is correct (the set of options is small) and just assume that what follows it is correct (and of course catch any exceptions you might encounter when you put it to actual use).

Also note the comment above:

If another primary type is to be used for any reason, it must be given a name starting with "X-" to indicate its non-standard status and to avoid any potential conflict with a future official name.

You'll notice that a lot of HTTP requests/responses include an X- header of some sort which are self defined, keep this in mind when validating the types.

Community
  • 1
  • 1
Jeroen Vannevel
  • 43,651
  • 22
  • 107
  • 170
3

I would aim at covering a subset of possible "Content-type" values, you question seems to focus on identifying known content types.

@Jeroen RFC 1341 reference is great, but for an fairly exhaustive list IANA keeps a web page of officially registered media types here.

MD XF
  • 7,860
  • 7
  • 40
  • 71
Peter Hornsby
  • 4,208
  • 1
  • 25
  • 44
  • Those are not "known" mediatypes (i.e. samples of what has been observed "in the wild") but mediatypes that went through the IANA registration procedures. They are therefore officially registered. Found it important to point this out :) – DaSourcerer May 17 '16 at 16:24
0

If you are using jaxrs or any other, then there will be a class called mediatype.User interceptor before sending the request and compare it against this.

Awesome
  • 5,689
  • 8
  • 33
  • 58
geddamsatish
  • 174
  • 10