What is a MIME type (Content-Type)?

Short answer

A MIME type (media type) is the label that states the format of a piece of content in the type/subtype form: such as text/html, application/json, image/png, multipart/form-data. In HTTP, it is carried in the Content-Type header; it tells the type of the body sent in the request or of the content returned in the response. In TR7, the MIME type is decisive in the following places: the Compression profile compresses only the types in the File Types list; WAF limits the type of uploaded files with the Allowed Upload Mime Types list and the type of the raw body with the Allowed Raw Body Mime Types list, and it detects the type from the content, not from the Content-Type the client states; the content in the Content Pages profile and on the WAF blocking page is sent with the selected type. In the vService Report, the request and response content types are listed separately.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Profiles (L4-L7 Behavior Sets) → Compression	File Types (default text/plain; at least one type)	The response types to be compressed
WAF → WAF-Protected vService List → WAF Management → rule → Form	Allowed Upload Mime Types	The allowed types of the files uploaded with multipart/form-data
Same rule → Raw	Allowed Raw Body Mime Types	The allowed types of bodies that are not JSON, XML or a form
WAF → WAF-Protected vService List → WAF Management → Blocking Page	Blocking Page Content Type	The type of the manually written blocking page
Load Balancer → Profiles (L4-L7 Behavior Sets) → Content Pages	Content Type (default text/html)	The type of the ready content page stated in the response
Load Balancer → Actions (Policy Actions) → Manage HTTP Security Headers	Response Headers → X-Content-Type-Options ("nosniff")	Preventing the browser from guessing the response type from the content
Load Balancer → Load Balancer vService List → vService → Report	Request Content Type, Response content type	The type distribution of the request and response bodies

Common Misconceptions

• "Content-Type proves the real type of the file." The value is written by the client. The WAF file type check does not use this header; it detects the type from the content of the file; unrecognized binary files (e.g. .exe) are detected as application/octet-stream, and since this type is in the default list, they pass: Does the file type check look at the client's Content-Type or at the file's content?
• "All responses are compressed." Only the types in the File Types list of the Compression profile are compressed; the default list contains only text/plain, and types such as text/html and application/json are added to the list.
• "A MIME type and a file extension are the same thing." The browser and the server interpret the content according to the Content-Type, not the extension; content stated with the wrong type is displayed incorrectly.

How it is done in the documentation

• Compression · File Types
• Compression · The MIME Type Match
• Form · Allowed Upload Mime Types
• Raw · Allowed Raw Body Mime Types
• Content Pages · Content Type

Related questions

• Can I allow only certain MIME types in file uploads?
• What is Allowed Raw Body Mime Types used for?
• Does the file type check look at the client's Content-Type or at the file's content?
• What is X-Content-Type-Options: nosniff?