font/woff2
Basic information
| Type | font |
|---|---|
| Subtype | woff2 |
| Structured suffix | None |
| File extensions | .woff2 |
| Category | Font |
| Standard | IANA media type registry or common platform registration |
MIME anatomy
font/woff2 has a top-level type of font and a subtype of woff2. The top-level type tells clients the broad handling model, while the subtype identifies the exact format, codec family, document type, or container.
| Part | Value | What to check |
|---|---|---|
| Top-level type | font | Controls broad behavior such as text rendering, image decoding, download handling, or multipart parsing. |
| Subtype | woff2 | Should match the real file format, not only the filename extension. |
| Structured suffix | None | No structured suffix is declared for this type. |
| Charset | Binary | Do not add a charset parameter to binary payloads. |
| Binary payload | Yes | Treat the body as bytes and avoid text transformations. |
HTTP header
Content-Type: font/woff2Common use
Use font/woff2 in Content-Type and Accept headers when serving or requesting WOFF2 font. Correct MIME types help browsers, APIs, uploads, and download workflows handle files safely and predictably.
Browser support depends on the media type and the feature using it. Browsers can download almost any MIME type, but only selected text, image, audio, video, font, and document types are rendered natively.
For uploads, do not trust the file extension alone. Check the declared MIME type, validate the file signature when security matters, and store the original extension separately from the trusted server-side classification.
Browser and API behavior
| Context | How font/woff2 is used | Practical check |
|---|---|---|
| HTTP response | Send font/woff2 so clients choose the right parser or renderer. | Inspect the Network panel and confirm the response header, not just the file extension. |
| HTTP request | Use Accept: font/woff2 when an API can return several formats. | Return 406 Not Acceptable or a documented fallback when the type is unavailable. |
| Upload form | Use file extension and declared MIME type as hints. | For risky uploads, verify magic bytes or parse the file before trusting it. |
| Storage | Store the trusted MIME classification separately from the original filename. | This keeps later downloads correct even if a user uploads a misleading name. |
Common mistakes
- Serving binary content as
application/octet-streamwhen the browser or API client expectsfont/woff2. - Assuming .woff2 proves the file is safe. Extensions are user-controlled and should be treated as hints.
- Adding a charset parameter to binary content. Binary formats should normally be sent without charset.
HTML download
<a href="/download.woff2" download type="font/woff2">Download file</a>fetch Accept header
fetch("/api/file", {
headers: { Accept: "font/woff2" }
});multer upload filter
const upload = multer({
fileFilter: (req, file, cb) => cb(null, file.mimetype === "font/woff2")
});Express response
app.get("/file", async (req, res) => {
res.setHeader("Content-Type", "font/woff2");
res.send(await readFile("example.woff2"));
});Flask response
from flask import send_file
@app.get("/file")
def file():
return send_file("example.woff2", mimetype="font/woff2", as_attachment=False)Go net/http response
func handler(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "font/woff2")
http.ServeFile(w, r, "example.woff2")
}Nginx type mapping
types {
font/woff2 woff2;
}
default_type application/octet-stream;curl negotiation
curl -H "Accept: font/woff2" https://example.com/file.woff2Validation checklist
| Check | Recommended handling |
|---|---|
| Declared type | Compare the uploaded or generated MIME value with font/woff2 when this exact format is required. |
| Extension | Accept .woff2 only as a convenience signal, not as proof of content. |
| Signature or parser | Validate the binary signature or parse the container when untrusted users can upload files. |
| Download safety | Set Content-Disposition deliberately when the file should download instead of render inline. |
| Caching | Use cache headers that match the file lifecycle, especially for generated assets and user uploads. |