TToolumina

application/xml

application/xml is used for XML documents.

Application

application/xml

Basic information

Typeapplication
Subtypexml
Structured suffixNone
File extensions.xml
CategoryApplication
StandardIANA media type registry or common platform registration

MIME anatomy

application/xml has a top-level type of application and a subtype of xml. The top-level type tells clients the broad handling model, while the subtype identifies the exact format, codec family, document type, or container.

PartValueWhat to check
Top-level typeapplicationControls broad behavior such as text rendering, image decoding, download handling, or multipart parsing.
SubtypexmlShould match the real file format, not only the filename extension.
Structured suffixNoneNo structured suffix is declared for this type.
CharsetUTF-8Use charset=utf-8 when clients need deterministic text decoding.
Binary payloadNoText-aware tooling may inspect or transform the body when the charset is correct.

HTTP header

Content-Type: application/xml; charset=utf-8
UTF-8EncodingNoBinary.xmlExtensions

Common use

Use application/xml in Content-Type and Accept headers when serving or requesting XML documents. Correct MIME types help browsers, APIs, uploads, and download workflows handle files safely and predictably.

Browser support depends on the media type and the feature using it. Browsers can download almost any MIME type, but only selected text, image, audio, video, font, and document types are rendered natively.

For uploads, do not trust the file extension alone. Check the declared MIME type, validate the file signature when security matters, and store the original extension separately from the trusted server-side classification.

Browser and API behavior

ContextHow application/xml is usedPractical check
HTTP responseSend application/xml; charset=utf-8 so clients choose the right parser or renderer.Inspect the Network panel and confirm the response header, not just the file extension.
HTTP requestUse Accept: application/xml when an API can return several formats.Return 406 Not Acceptable or a documented fallback when the type is unavailable.
Upload formUse file extension and declared MIME type as hints.For risky uploads, verify magic bytes or parse the file before trusting it.
StorageStore the trusted MIME classification separately from the original filename.This keeps later downloads correct even if a user uploads a misleading name.

Common mistakes

  • Serving text content as application/octet-stream when the browser or API client expects application/xml.
  • Assuming .xml proves the file is safe. Extensions are user-controlled and should be treated as hints.
  • Omitting charset when clients need deterministic text decoding. For this type, UTF-8 is the usual choice.

HTML download

<a href="/download.xml" download type="application/xml">Download file</a>

fetch Accept header

fetch("/api/file", {
  headers: { Accept: "application/xml" }
});

multer upload filter

const upload = multer({
  fileFilter: (req, file, cb) => cb(null, file.mimetype === "application/xml")
});

Express response

app.get("/file", async (req, res) => {
  res.setHeader("Content-Type", "application/xml; charset=utf-8");
  res.send(await readFile("example.xml"));
});

Flask response

from flask import send_file

@app.get("/file")
def file():
    return send_file("example.xml", mimetype="application/xml", as_attachment=False)

Go net/http response

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/xml; charset=utf-8")
    http.ServeFile(w, r, "example.xml")
}

Nginx type mapping

types {
    application/xml xml;
}
default_type application/octet-stream;

curl negotiation

curl -H "Accept: application/xml" https://example.com/file.xml

Validation checklist

CheckRecommended handling
Declared typeCompare the uploaded or generated MIME value with application/xml when this exact format is required.
ExtensionAccept .xml only as a convenience signal, not as proof of content.
Signature or parserDecode using the expected charset and reject malformed text when strict processing matters.
Download safetySet Content-Disposition deliberately when the file should download instead of render inline.
CachingUse cache headers that match the file lifecycle, especially for generated assets and user uploads.

Related reference pages