Demo Company
Label it · Media type lab
The address says where a file is. The Content-Type label on the
response says what it is, and the browser acts on the label. Below, one small file,
logo.svg, arrives under five different labels. The bytes never change.
Watch what the browser does with each, and read the exchange beside it.
From the film Three Things In, Three Things Out.
image/svg+xml: drawn as a picture
text/plain: shown as its source
text/html: drawn, because HTML can hold SVG inline
application/octet-stream: saved, not shown
“Just bytes” gives the browser nothing to show, so it offers to save them. Click to fetch logo.svg with this label and watch your downloads.
No label: the browser guesses
With no label, the browser inspects the first bytes and decides for itself
(“sniffing”). Different browsers guess differently, which is why a server should always label.
An SVG file is not on the list of patterns browsers sniff as HTML, so here the guess is plain
text; a file starting <!doctype html> would be guessed as a page.
nosniff: a wrongly labelled script is refused
The same script, labelled text/plain, loaded twice as a <script>:
- Without
X-Content-Type-Options: nosniff: checking… - With it: checking…
Content-Disposition: shown, or saved
The same HTML with Content-Disposition: attachment:
click to fetch page.html again, and it is saved instead of shown.
Try your own
Every example above is a lab address you can edit. Open, for example,
/lab/data.json?type=html and change the label.
Files: cat.webp, page.html, logo.svg, script.js,
style.css, data.json, notes.txt.
Labels (type): html, plain, css, js,
json, svg, webp, octet, none.
Also nosniff=1, download=1,
status (200, 304, 404, 410, 500, 503), delay (0 to 10000 ms),
cache (none, revalidate, year) and
encoding (identity, gzip, br).