SVG MIME Type – Free, Online, Private

What .svg is

SVG is an XML document that describes shapes, text, and filters. A file often starts with an XML declaration or with the <svg element. The root is in the SVG namespace. Because it is XML, a well-formedness error blanks the image, and an external entity declaration is a parser feature you do not want on an upload. Gzip-compressed SVG is sometimes named .svgz. That is still SVG after inflation, and the type stays image/svg+xml if you inflate it in the server, or you serve the compressed bytes with Content-Encoding: gzip. This page covers .svg.

IANA registers image/svg+xml for Scalable Vector Graphics. The media type is image/svg+xml. Extensions that use it on this page: .svg. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends image/svg+xml

What sends image/svg+xml: Send image/svg+xml; charset=utf-8 for a static icon or an illustration. An img tag will display it and will not run script in current browsers. Inline SVG in HTML does run script, and that is HTML, not this type. A user who opens the .svg URL directly gets a document, and script in that document runs. That is why an uploaded SVG is an XSS payload if you host it on your application origin. Serve untrusted SVG from a separate host, or sanitize it until no script, no foreignObject with HTML, and no external references remain. The file on disk is still .svg. Once the response exists, a client trusts image/svg+xml, not the filename. Use SVG for logos and icons that must stay sharp. Use PNG or WebP when the image is a photograph or a screenshot of text the user will select in the page rather than in the graphic. If you sprite many icons into one SVG, the type is still image/svg+xml. The fragment identifier that picks a symbol is part of the URL, not part of the media type.

Content-Type for .svg

Send image/svg+xml; charset=utf-8. The charset parameter names the encoding of the body. Leaving it off forces the client to guess, and for several text types the registered default is not UTF-8. Do not send a charset on a redirect. The header belongs on the response that contains the bytes.

Content-TypeContent-Type: image/svg+xml; charset=utf-8

nginx, Apache, and Express

These snippets map .svg to image/svg+xml. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .svg so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
image/svg+xml               svg;
charset utf-8;
charset_types image/svg+xml;

ApacheAddType image/svg+xml .svg
AddCharset UTF-8 .svg

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".svg")) {
      res.setHeader("Content-Type", "image/svg+xml; charset=utf-8");
    }
  },
}));

Pitfalls for image/svg+xml

Pitfalls that show up for image/svg+xml, and not for a neighboring type with a similar extension: The type string people invent is image/svg. It is not registered, and a strict image pipeline drops the file. Use image/svg+xml. A second trap is serving SVG as text/html, which makes the browser build an HTML document and execute embedded markup with the page's origin. A third is a CDN that minifies the XML and breaks the namespace prefix. A fourth is caching one SVG URL for many users when the file was generated with a user's name in a text node. The type is cacheable. The content may not be.

• script, onload, and foreignObject are the XSS surface. Stripping the script element and leaving onload does not sanitize the file.
• image/svg+xml can be sniffed as an image. X-Content-Type-Options: nosniff stops a browser from treating a non-SVG body as something else, and it does not remove script from a real SVG document.
• A missing xmlns makes some tools treat the file as generic XML. Browsers are forgiving. Validators are not.
• UTF-16 SVG exists and is a bad idea on the web. Publish UTF-8 and say so in the header.