XML MIME Type – Free, Online, Private

What .xml is

XML is a text format with elements, attributes, and a single root. A file often starts with an XML declaration that names an encoding. The declaration is not the HTTP charset, and RFC 7303 explains how the two interact. application/xml is the type to send. text/xml is still registered and is a trap: as a text/* type it inherited a default of US-ASCII when the charset parameter is missing, which corrupts a UTF-8 document that has no BOM and no declaration a given parser honors. Use application/xml; charset=utf-8 for a document you encoded as UTF-8.

IANA registers application/xml and text/xml in RFC 7303. application/xml is the one to send. The media type is application/xml. Extensions that use it on this page: .xml. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/xml

What sends application/xml: Send application/xml for a document, a sitemap, a feed you have not given a more specific type, and an API that still speaks XML. If the document is XHTML, SVG, Atom, or RSS with its own type, use the specific type. Those types tell the client which vocabulary this is. application/xml only says 'XML'. A browser that receives application/xml shows a tree. A browser that receives text/html runs scripts. That difference is the XSS boundary. Do not let a framework's HTML error page replace an XML error. The error should stay application/xml or it should be a problem+json response with a matching status. The file on disk is still .xml. Once the response exists, a client trusts application/xml, not the filename. More specific types exist for a reason. image/svg+xml, application/xhtml+xml, application/atom+xml, and application/vnd.google-earth.kml+xml tell a client what to do. Fall back to application/xml when you do not have a more specific registration, not when you do.

Content-Type for .xml

Send application/xml; charset=utf-8. The charset parameter names the encoding of the body. Leaving it off forces the client to guess, and for several text types the registered default is not UTF-8. Do not send a charset on a redirect. The header belongs on the response that contains the bytes.

Content-TypeContent-Type: application/xml; charset=utf-8

nginx, Apache, and Express

These snippets map .xml to application/xml. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .xml so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/xml             xml;
charset utf-8;
charset_types application/xml;

ApacheAddType application/xml .xml
AddCharset UTF-8 .xml

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".xml")) {
      res.setHeader("Content-Type", "application/xml; charset=utf-8");
    }
  },
}));

Pitfalls for application/xml

Pitfalls that show up for application/xml, and not for a neighboring type with a similar extension: XXE is a parser feature. A document type with an external entity can make the server fetch a URL or read a file when it parses untrusted XML. The media type does not disable that. Configure the parser. Another trap is serving user XML as text/html because both are 'markup'. A third is an encoding declaration that says ISO-8859-1 while the HTTP charset says utf-8. Pick one story and make the bytes match. A fourth is gzip plus a BOM plus a declaration, which is legal and still trips a hand-rolled scanner that looks for < at byte zero.

• text/xml is registered and you should still stop sending it. application/xml avoids the US-ASCII default.
• application/xml does not mean the document is safe to render as HTML.
• A byte-order mark is allowed and is easy to miss when you concatenate documents.
• Sitemap XML is still XML. Search engines also want the URL to be fetchable. The type alone does not submit the sitemap.