XLS MIME Type – Free, Online, Private

What .xls is

Binary Excel shares the OLE compound file signature D0 CF 11 E0 with old Word and PowerPoint documents. The workbook stream inside is what makes it Excel. IANA registers application/vnd.ms-excel. The Open XML .xlsx type is different and the file starts with PK. HTML tables with an .xls extension were a long-lived export hack. They are not this type. If the body is HTML, send text/html or, better, produce a real workbook or a CSV. application/vnd.ms-excel on an HTML body is why some corporate exports 'open' and then show a warning.

IANA registers application/vnd.ms-excel. The media type is application/vnd.ms-excel. Extensions that use it on this page: .xls. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/vnd.ms-excel

What sends application/vnd.ms-excel: Send application/vnd.ms-excel for a genuine binary workbook download. Set a .xls filename. For anything you generate now, prefer .xlsx with the spreadsheetml type, or text/csv when the consumer does not need formatting. Do not add a charset. If a client asks for Excel and you only have rows, say so and send CSV rather than wrapping a CSV in this type. Spreadsheet programs that trusted the header will try to parse OLE and fail. The file on disk is still .xls. Once the response exists, a client trusts application/vnd.ms-excel, not the filename. A download button that used to stream HTML with this type should be deleted, not preserved for compatibility. Clients that depended on the hack can get a real xlsx. Keeping the hack means every new security filter that sniffs HTML will block the download.

Content-Type for .xls

Send application/vnd.ms-excel and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/vnd.ms-excel

nginx, Apache, and Express

These snippets map .xls to application/vnd.ms-excel. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .xls so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/vnd.ms-excel    xls;

ApacheAddType application/vnd.ms-excel .xls

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".xls")) {
      res.setHeader("Content-Type", "application/vnd.ms-excel");
    }
  },
}));

Pitfalls for application/vnd.ms-excel

Pitfalls that show up for application/vnd.ms-excel, and not for a neighboring type with a similar extension: One mapping for .xls and .xlsx is the same bug as on Word. Separate them. A second bug is the HTML-as-xls export. Check the first bytes. OLE or PK or an angle bracket are three different files. A third is a workbook with macros served to a browser that saves it and a user who enables content. The type does not disable macros. A fourth is a partial OLE file from a failed upload that still starts with D0 CF 11 E0. Check the length before you store it as a successful export.

• application/vnd.ms-excel is the binary type. The .xlsx type is application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.
• text/csv is not a workbook. Do not send the Excel type for comma-separated text.
• The OLE header is not unique to Excel. Do not use it as the only test if you also accept .doc.
• application/xls is not registered.