XLSX MIME Type – Free, Online, Private

What .xlsx is

XLSX is an Office Open XML spreadsheet. It is a ZIP file containing [Content_Types].xml, xl/workbook.xml, and one or more worksheets. Shared strings often live in xl/sharedStrings.xml. IANA registers application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. A CSV export of the same grid is text/csv and is a different file: one sheet, no formulas, no types. The old binary .xls format is application/vnd.ms-excel. A macro-enabled .xlsm is application/vnd.ms-excel.sheet.macroEnabled.12. Sending the plain sheet type for a macro workbook hides the macro.

IANA registers application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. The media type is application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. Extensions that use it on this page: .xlsx. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

What sends application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: Send the spreadsheetml sheet type for a .xlsx download. Set a .xlsx filename. Do not add a charset. If an API returns rows for a program to parse, JSON or CSV is a better response and a better type. Reserve this type for a workbook a person will open. Generating XLSX is building a ZIP with the right parts and relationships, not concatenating XML. A missing [Content_Types].xml produces a file Excel calls corrupt. The HTTP type can still be perfect. The file on disk is still .xlsx. Once the response exists, a client trusts application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, not the filename. If you offer both CSV and XLSX, use two URLs. A format query parameter that changes the body from text to a ZIP needs Vary or it will poison a cache. Two paths, two types, no negotiation, is the setup that fails less often.

Content-Type for .xlsx

Send application/vnd.openxmlformats-officedocument.spreadsheetml.sheet and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

nginx, Apache, and Express

These snippets map .xlsx to application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .xlsx so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet  xlsx;

ApacheAddType application/vnd.openxmlformats-officedocument.spreadsheetml.sheet .xlsx

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".xlsx")) {
      res.setHeader("Content-Type", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
    }
  },
}));

Pitfalls for application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Pitfalls that show up for application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, and not for a neighboring type with a similar extension: Numbers that are identifiers, such as a postal code or a product SKU with a leading zero, get coerced when someone opens a CSV. An XLSX can keep them as text if you write the cell type. The media type does not set the cell type. Another trap is a generated workbook with a formula that a spreadsheet will execute when opened, built from untrusted input. Do not assemble formulas from strings you do not control. Another is a very large shared-strings table that exhausts memory in a client. Another is serving the workbook as text/csv from a 'export' button that used to be CSV and now writes XLSX.

• The type is application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. application/zip is the container only.
• text/csv is a flat export. Do not label an XLSX body as CSV.
• application/vnd.ms-excel is the binary .xls type.
• .xlsm is the macro type, not this one.