RFC 3023

XML Media Types

📅 published January 2001, from ietf

RFC 3023: XML Media Types 🎀

Okay bestie, this is RFC 3023, and it's all about XML Media Types 💅 It came out in January 2001 as a Standards Track document from the Network Working Group ✨ The authors are M. Murata (IBM Tokyo Research Laboratory), S. St.Laurent (simonstl.com), and D. Kohn (Skymoon Ventures) 🫶

This one obsoletes RFC 2376, so that older version is officially retired 😭 It also updates RFC 2048, which is the registration process the +xml suffix convention changes 🦋

Status of This Memo 📜

This document specifies an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🌸 If you want to know where this protocol stands in standardization, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💖

Copyright (C) The Internet Society (2001). All Rights Reserved. 🌈

Abstract ✨

Okay, so this doc standardizes five new media types for XML network entities: text/xml, application/xml, text/xml-external-parsed-entity, application/xml-external-parsed-entity, and application/xml-dtd 🎀 It also sets up a naming convention. If a media type outside those five represents an XML MIME (Multipurpose Internet Mail Extensions) entity, its name gets the suffix +xml 🧚

Why does this matter? XML MIME entities are already moving around the World Wide Web over HTTP, they're a core part of WebDAV for remote web authoring, and they're expected to be useful in lots of other areas too 🔥

Compared to RFC 2376, the big changes are (1) the three new types text/xml-external-parsed-entity, application/xml-external-parsed-entity, and application/xml-dtd, (2) the +xml suffix convention, which also updates the RFC 2048 registration process, and (3) the discussion of "utf-16le" and "utf-16be" 👑

Table of Contents

   1.   Introduction . . . . . . . . . . . . . . . . . . . . . . . .   3
   2.   Notational Conventions . . . . . . . . . . . . . . . . . . .   4
   3.   XML Media Types  . . . . . . . . . . . . . . . . . . . . . .   5
   3.1  Text/xml Registration  . . . . . . . . . . . . . . . . . . .   7
   3.2  Application/xml Registration . . . . . . . . . . . . . . . .   9
   3.3  Text/xml-external-parsed-entity Registration . . . . . . . .  11
   3.4  Application/xml-external-parsed-entity Registration  . . . .  12
   3.5  Application/xml-dtd Registration . . . . . . . . . . . . . .  13
   3.6  Summary  . . . . . . . . . . . . . . . . . . . . . . . . . .  14
   4.   The Byte Order Mark (BOM) and Conversions to/from the UTF-16
        Charset  . . . . . . . . . . . . . . . . . . . . . . . . . .  15
   5.   Fragment Identifiers . . . . . . . . . . . . . . . . . . . .  15
   6.   The Base URI . . . . . . . . . . . . . . . . . . . . . . . .  15
   7.   A Naming Convention for XML-Based Media Types  . . . . . . .  16
   7.1  Referencing  . . . . . . . . . . . . . . . . . . . . . . . .  18
   8.   Examples . . . . . . . . . . . . . . . . . . . . . . . . . .  18
   8.1  Text/xml with UTF-8 Charset  . . . . . . . . . . . . . . . .  19
   8.2  Text/xml with UTF-16 Charset . . . . . . . . . . . . . . . .  19
   8.3  Text/xml with UTF-16BE Charset . . . . . . . . . . . . . . .  19
   8.4  Text/xml with ISO-2022-KR Charset  . . . . . . . . . . . . .  20
   8.5  Text/xml with Omitted Charset  . . . . . . . . . . . . . . .  20
   8.6  Application/xml with UTF-16 Charset  . . . . . . . . . . . .  20
   8.7  Application/xml with UTF-16BE Charset  . . . . . . . . . . .  21
   8.8  Application/xml with ISO-2022-KR Charset . . . . . . . . . .  21
   8.9  Application/xml with Omitted Charset and UTF-16 XML MIME
        Entity . . . . . . . . . . . . . . . . . . . . . . . . . . .  21
   8.10 Application/xml with Omitted Charset and UTF-8 Entity  . . .  22
   8.11 Application/xml with Omitted Charset and Internal Encoding
        Declaration  . . . . . . . . . . . . . . . . . . . . . . . .  22
   8.12 Text/xml-external-parsed-entity with UTF-8 Charset . . . . .  22
   8.13 Application/xml-external-parsed-entity with UTF-16 Charset .  23
   8.14 Application/xml-external-parsed-entity with UTF-16BE Charset  23
   8.15 Application/xml-dtd  . . . . . . . . . . . . . . . . . . . .  23
   8.16 Application/mathml+xml . . . . . . . . . . . . . . . . . . .  24
   8.17 Application/xslt+xml . . . . . . . . . . . . . . . . . . . .  24
   8.18 Application/rdf+xml  . . . . . . . . . . . . . . . . . . . .  24
   8.19 Image/svg+xml  . . . . . . . . . . . . . . . . . . . . . . .  24
   8.20 INCONSISTENT EXAMPLE: Text/xml with UTF-8 Charset  . . . . .  25
   9.   IANA Considerations  . . . . . . . . . . . . . . . . . . . .  25
   10.  Security Considerations  . . . . . . . . . . . . . . . . . .  25
        References . . . . . . . . . . . . . . . . . . . . . . . . .  27
        Authors' Addresses . . . . . . . . . . . . . . . . . . . . .  31
   A.   Why Use the '+xml' Suffix for XML-Based MIME Types?  . . . .  32
   A.1  Why not just use text/xml or application/xml and let the XML
        processor dispatch to the correct application based on the
        referenced DTD?  . . . . . . . . . . . . . . . . . . . . . .  32

   A.2  Why not create a new subtree (e.g., image/xml.svg) to
        represent XML MIME types?  . . . . . . . . . . . . . . . . .  32
   A.3  Why not create a new top-level MIME type for XML-based media
        types? . . . . . . . . . . . . . . . . . . . . . . . . . . .  32
   A.4  Why not just have the MIME processor 'sniff' the content to
        determine whether it is XML? . . . . . . . . . . . . . . . .  33
   A.5  Why not use a MIME parameter to specify that a media type
        uses XML syntax? . . . . . . . . . . . . . . . . . . . . . .  33
   A.6  How about labeling with parameters in the other direction
        (e.g., application/xml; Content-Feature=iotp)? . . . . . . .  34
   A.7  How about a new superclass MIME parameter that is defined to
        apply to all MIME types (e.g., Content-Type:
        application/iotp; $superclass=xml)?  . . . . . . . . . . . .  34
   A.8  What about adding a new parameter to the Content-Disposition
        header or creating a new Content-Structure header to
        indicate XML syntax? . . . . . . . . . . . . . . . . . . . .  35
   A.9  How about a new Alternative-Content-Type header? . . . . . .  35
   A.10 How about using a conneg tag instead (e.g., accept-features:
        (syntax=xml))? . . . . . . . . . . . . . . . . . . . . . . .  35
   A.11 How about a third-level content-type, such as text/xml/rdf?   35
   A.12 Why use the plus ('+') character for the suffix '+xml'?  . .  36
   A.13 What is the semantic difference between application/foo and
        application/foo+xml? . . . . . . . . . . . . . . . . . . . .  36
   A.14 What happens when an even better markup language (e.g.,
        EBML) is defined, or a new category of data? . . . . . . . .  36
   A.15 Why must I use the '+xml' suffix for my new XML-based media
        type?  . . . . . . . . . . . . . . . . . . . . . . . . . . .  37
   B.   Changes from RFC 2376  . . . . . . . . . . . . . . . . . . .  37
   C.   Acknowledgements . . . . . . . . . . . . . . . . . . . . . .  38
        Full Copyright Statement . . . . . . . . . . . . . . . . . .  39

1. Introduction 🌸

So the World Wide Web Consortium put out Extensible Markup Language (XML) 1.0 (Second Edition) [XML] 🧚 To let XML network entities actually get exchanged, this doc standardizes those five new media types (text/xml, application/xml, text/xml-external-parsed-entity, application/xml-external-parsed-entity, and application/xml-dtd) and also a naming convention for identifying XML-based MIME media types 💅

XML entities are already flowing around the World Wide Web, and XML is used for property values and parameter marshalling by the WebDAV [RFC2518] protocol for remote web authoring 🦋 So yeah, there's a real need for a media type that properly labels XML network entities ✨

Here's the thing: XML is a subset of the Standard Generalized Markup Language (SGML) ISO 8879 [SGML], and SGML already has the media types text/sgml and application/sgml. But using those to label XML is not the move, and there are three reasons 🙈 First, lots of apps can process XML but can't process SGML, because SGML has a bigger feature set. Second, SGML apps can't always handle XML entities, since XML uses features from recent technical corrigenda to SGML. Third, the definitions of text/sgml and application/sgml in [RFC1874] include parameters for SGML bit combination transformation format (SGML-bctf) and SGML boot attribute (SGML-boot). XML doesn't use those, so it'd be ambiguous if they showed up on an XML MIME entity 😭 So the best approach is brand new media types for XML 👑

XML is also an integral part of the WebDAV Distributed Authoring Protocol, World Wide Web Consortium Recommendations have traditionally been given IETF tree media types, and similar formats (HTML, SGML) already live there. So the XML media types belong in the IETF media types tree too 🎀

And it doesn't stop there. XML is going to be the foundation for other media types in every branch of the IETF media types tree. To make those easier to process, media types based on XML that aren't named text/xml or application/xml SHOULD be named with the suffix +xml, as described in Section 7. That way XML-based tools (browsers, editors, search engines, and other processors) can work with all XML-based media types at once 🔥

2. Notational Conventions 📝

Here's the key words situation. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💖

As defined in [RFC2781], the three charsets "utf-16", "utf-16le", and "utf-16be" are used to label UTF-16 text. In this document, "the UTF-16 family" refers to those three charsets. By contrast, the phrases "utf-16" or UTF-16 in this document refer specifically to the single charset "utf-16" 🫶

Now, a little drama: MIME and XML both defined the term entity, and they mean different things 🙃 Section 2.4 of [RFC2045] says:

"The term 'entity' refers specifically to the MIME-defined header fields and contents of either a message or one of the parts in the body of a multipart entity."

Section 4 of [XML] says:

"An XML document may consist of one or many storage units" called entities that "have content" and are normally "identified by name".

So in this document, "XML MIME entity" means the latter (an XML entity) wrapped up inside the former (a MIME entity) 🌈

3. XML Media Types ✨

okay bestie, this is where the real fun begins 🎀 RFC 3023 standardizes five media types for XML MIME entities: text/xml, application/xml, text/xml-external-parsed-entity, application/xml-external-parsed-entity, and application/xml-dtd. The registration details for each one are in the sections below 💅

The XML spec sorts XML MIME entities into four kinds: "document entities", "external DTD subsets", "external parsed entities", and "external parameter entities" 📚 text/xml and application/xml MAY be used for document entities, and text/xml-external-parsed-entity or application/xml-external-parsed-entity SHOULD be used for external parsed entities. application/xml-dtd SHOULD be used for external DTD subsets or external parameter entities. Now the tea 🍵: application/xml and text/xml MUST NOT be used for external parameter entities or external DTD subsets, and they MUST NOT be used for external parsed entities unless those are also well-formed document entities and get referenced as such 🙈 Also, [RFC2376] (which this document obsoletes) allowed that kind of usage, although it was probably pretty rare in practice 🦋

Neither external DTD subsets nor external parameter entities parse as XML documents. Some XML document entities can be used as external parsed entities and the other way around, but there are plenty of cases where the two just aren't swappable 🌸 XML also has unparsed entities, internal parsed entities, and internal parameter entities, but those are NOT XML MIME entities, so no media type for them here 💜

If an XML document (the unprocessed, source XML document) is readable by casual users, text/xml is the better pick over application/xml 🧚 MIME user agents (and web user agents) that don't have explicit support for text/xml will treat it as text/plain and just display the XML MIME entity as plain text. application/xml is the better pick when casual users can't read the XML MIME entity anyway. Same vibe for text/xml-external-parsed-entity: it's better when casual users can read the external parsed entity, while application/xml-external-parsed-entity wins when plain text display would be a bad look 🫶

NOTE: Users are generally not used to text containing tags like <price>, and those tags often feel super disorienting or annoying 😭 If you're not sure, the conservative principle suggests using application/* instead of text/*, so you don't put stuff in front of users that they'll probably not understand 🙈

The top-level media type text has some restrictions on MIME entities, described in [RFC2045] and [RFC2046] 📖 Specifically, the UTF-16 family, UCS-4, and UTF-32 are not allowed, EXCEPT over HTTP[RFC2616], which uses a MIME-like mechanism 💅 So if an XML document or external parsed entity is encoded in one of those character encoding schemes, it can't be labeled as text/xml or text/xml-external-parsed-entity (unless it's going over HTTP) 🌈

text/xml and application/xml act differently when the charset parameter isn't explicitly specified 👑 If the default charset for text/xml (that's US-ASCII) is inconvenient for some reason, like bad web servers, application/xml gives you an alternative. Check "Optional parameters" of the application/xml registration in Section 3.2 for the details 🎀 The same rules apply to the split between text/xml-external-parsed-entity and application/xml-external-parsed-entity ✨

XML gives you a general framework for defining sequences of structured data 🦋 Sometimes you'll want new media types that use XML but define one specific application of it, maybe because of domain-specific security considerations or runtime information. Those media types might only allow UTF-8 or UTF-16 and ban other charsets 🍓 This document doesn't prohibit them, and honestly it EXPECTS them to multiply 🌸 That said, developers of those media types are STRONGLY RECOMMENDED to use this document as the basis for their registration. In particular, the charset parameter SHOULD be used the same way described in Section 7.1, so everything plays nicely together 🤝

An XML document labeled text/xml or application/xml might contain namespace declarations, stylesheet-linking processing instructions (PIs), schema info, or other declarations that suggest how to process the document ✨ For example, a document might have the XHTML namespace and a reference to a CSS stylesheet. Apps can use that info to send the document off for the right kind of processing 💖

3.1 Text/xml Registration 🌷

  • MIME media type name: text
  • MIME subtype name: xml
  • Mandatory parameters: none
  • Optional parameters: charset

Okay, so charset is technically optional, but using it is STRONGLY RECOMMENDED 💅 That's because XML processors can use this info to figure out the character encoding of the XML MIME entity for sure. The charset parameter can also power protocol-specific stuff, like charset-based content negotiation in HTTP. "utf-8" [RFC2279] is the recommended value (that's UTF-8), and every conforming XML processor supports it [XML] 🫧

If the XML MIME entity is sent over HTTP, which uses a MIME-like mechanism that's exempt from the text top-level type restrictions (see section 19.4.1 of [RFC2616]), "utf-16" [RFC2781] is also recommended. Every conforming XML processor supports UTF-16 too [XML] ✨ Now here's the catch 🙈: most MIME apps treat CR, LF, and NUL in text types in a way that would mess with individual octets inside UTF-16 multi-octet characters. So gateways going from HTTP to those MIME apps MUST transform the XML MIME entity from text/xml; charset="utf-16" to application/xml; charset="utf-16" 💀

Following [RFC2046], if a text/xml entity shows up without the charset parameter, MIME processors and XML processors MUST use the default charset value of "us-ascii" [ASCII]. Even when the XML MIME entity comes over HTTP, the default is still "us-ascii" 🌸 (Side note: this doesn't match HTTP/1.1, which uses ISO-8859-1 [ISO8859] as its default for historical reasons. XML is a new format, so a new default got picked for better I18N. US-ASCII won because it's the intersection of UTF-8 and ISO-8859-1, and MIME already uses it 🍵)

There are a few reasons the charset parameter is authoritative 👑

  • First, some MIME processing engines transcode MIME bodies of the top-level media type "text" without looking at any of the internal content. So an agent could quietly change text/xml; charset="iso-2022-jp" into text/xml; charset="utf-8" without touching the encoding declaration of the XML document 😭
  • Second, text/xml has to stay compatible with text/plain, because MIME agents that don't understand text/xml fall back to handling it as text/plain. If the charset parameter for text/xml weren't authoritative, that fallback would corrupt the data 💀
  • Third, recent web servers have gotten better, so users can specify the charset parameter now 🎀
  • Fourth, [RFC2130] says the recommended way to specify it is the "charset" parameter 🦋

Since the charset parameter is authoritative, the charset doesn't always get declared inside an XML encoding declaration. So you need to be extra careful when the recipient strips the MIME header and stores the received XML MIME entity persistently (like in a file system) 📁 Unless the charset is UTF-8 or UTF-16, the recipient SHOULD also persistently store info about the charset, maybe by embedding a correct XML encoding declaration in the XML MIME entity itself 🧚

Encoding considerations: This media type MAY be encoded however makes sense for the charset and the capabilities of the underlying MIME transport 🌈 For 7-bit transports, data in UTF-8 MUST be encoded in quoted-printable or base64. For 8-bit clean transports (like 8BITMIME[RFC1652] ESMTP or NNTP[RFC0977]), UTF-8 doesn't need encoding. Over HTTP[RFC2616], you don't need a content-transfer-encoding at all, and UTF-16 is also an option 💖

Security considerations: See Section 10 🔐

Interoperability considerations: XML has proven interoperable across WebDAV clients and servers, and for import and export from a bunch of different XML authoring tools 🤝 For maximum interop, validating processors are recommended. Non-validating processors can be more efficient, but they aren't required to handle every XML feature. For more info, check sub-section 2.9 "Standalone Document Declaration" and section 5 "Conformance" of [XML] 📚

Published specification: Extensible Markup Language (XML) 1.0 (Second Edition) [XML] 📜

Applications which use this media type: XML is device-, platform-, and vendor-neutral, and it's supported by a wide range of Web user agents, WebDAV [RFC2518] clients and servers, and XML authoring tools 👑

Additional information:

  • Magic number(s): None. Even so, no byte sequences can be counted on to always be present. XML MIME entities in ASCII-compatible charsets (including UTF-8) often begin with hexadecimal 3C 3F 78 6D 6C (<?xml), and those in UTF-16 often begin with hexadecimal FE FF 00 3C 00 3F 00 78 00 6D 00 6C or FF FE 3C 00 3F 00 78 00 6D 00 6C 00 (the Byte Order Mark (BOM) followed by <?xml). For more info, see Appendix F of [XML] 🔍
  • File extension(s): .xml 📎
  • Macintosh File Type Code(s): "TEXT" 🍎

Person and email address for further information:

  • MURATA Makoto (FAMILY Given) <mmurata@trl.ibm.co.jp> 🌸
  • Simon St.Laurent <simonstl@simonstl.com> 🦋
  • Daniel Kohn <dan@dankohn.com> 💜

Intended usage: COMMON ✨

Author/Change controller: The XML specification is a work product of the World Wide Web Consortium's XML Working Group, and it was edited by:

  • Tim Bray <tbray@textuality.com> 🧚
  • Jean Paoli <jeanpa@microsoft.com> 🎀
  • C. M. Sperberg-McQueen <cmsmcq@uic.edu> 🌈
  • Eve Maler <eve.maler@east.sun.com> 💖

The W3C and the W3C XML Core Working Group have change control over the XML specification, so they're the ones with the final say 👑🫶

3.2. Application/xml Registration 🎀

okay so bestie, this one is the application/xml registration and it's giving main character energy 💅✨

MIME media type name: application

MIME subtype name: xml

Mandatory parameters: none Optional parameters: charset

Okay, so even though charset is listed as an optional parameter, using it is STRONGLY RECOMMENDED 🫶💖. Why? Because XML processors can use it to figure out the charset of the XML MIME entity authoritatively 🔍. The charset parameter can also power protocol-specific stuff, like charset-based content negotiation in HTTP 🌈.

"utf-8" [RFC2279] and "utf-16" [RFC2781] are the recommended values 💜. They stand for the UTF-8 and UTF-16 charsets, and they're the faves because every conforming processor of [XML] supports them 👑.

If an application/xml entity shows up with no charset parameter, the MIME Content-Type header isn't telling you anything about the charset 🙈. Conforming XML processors MUST follow the requirements in section 4.3.3 of [XML] that deal with exactly this situation 🔥. But MIME processors that aren't XML processors SHOULD NOT assume a default charset when the charset parameter is missing 💀.

So why is the charset parameter the boss? First, recent web servers have gotten better and let users set it 🍓. Second, [RFC2130] says the recommended way to specify it is the "charset" parameter 🧚.

Now, lowkey, some people argue the charset parameter should be left out entirely, and that you should only rely on the mechanism in Appendix F of [XML] (which is non-normative) 🦋. The vibe is that users wouldn't have to configure the charset parameter at all. A stored XML document is likely to have a correct encoding declaration or BOM (if needed), since the operating system doesn't usually keep charset info for files 📁. If users want to rely on the encoding declaration or BOM and hide charset info from protocols, they can decide not to use the parameter 🌸.

Here's the tea ☕: because the charset parameter is authoritative, the charset isn't always written inside an XML encoding declaration. So be careful when the recipient strips the MIME header and saves the received XML MIME entity persistently (like in a file system) 😭. Unless the charset is UTF-8 or UTF-16, the recipient SHOULD also store the charset information persistently, maybe by embedding a correct XML encoding declaration inside the XML MIME entity 🎀.

Encoding considerations: This media type MAY be encoded however suits the charset and the capabilities of the underlying MIME transport 🦋. For 7-bit transports, data in either UTF-8 or UTF-16 MUST be encoded in quoted-printable or base64 🔒. For 8-bit clean transports (e.g., 8BITMIME[RFC1652] ESMTP or NNTP[RFC0977]), UTF-8 doesn't get encoded, but the UTF-16 family MUST be encoded in base64 🌊. For binary clean transports (e.g., HTTP[RFC2616]), no content-transfer-encoding is necessary ✨.

Security considerations: See Section 10. 🔐

Interoperability considerations: Same as Section 3.1. 🤝

Published specification: Same as Section 3.1. 📜

Applications which use this media type: Same as Section 3.1. 📱

Additional information: Same as Section 3.1. 💁

Person and email address for further information: Same as Section 3.1. 📧

Intended usage: COMMON 💯

Author/Change controller: Same as Section 3.1. 👑

3.3. Text/xml-external-parsed-entity Registration 🌸

MIME media type name: text

MIME subtype name: xml-external-parsed-entity

Mandatory parameters: none

Optional parameters: charset

The charset parameter here works exactly the same as it does for text/xml, as described in Section 3.1 🫶.

Encoding considerations: Same as Section 3.1. 🦋

Security considerations: See Section 10. 🔐

Interoperability considerations: XML external parsed entities are just as interoperable as XML documents 🤝. They have a less tightly constrained structure, though, so XML documents have to reference them for XML processors to handle them properly 🧩. Similarly, XML documents can't be reliably used as external parsed entities, because external parsed entities aren't allowed to have standalone document declarations or DTDs 🙅‍♀️. Giving XML external parsed entities their own content type should boost interoperability for both XML documents and XML external parsed entities 🚀.

Published specification: Same as Section 3.1. 📜

Applications which use this media type: Same as Section 3.1. 📱

Additional information:

Magic number(s): Same as Section 3.1. 🔮

File extension(s): .xml or .ent 📁

Macintosh File Type Code(s): "TEXT" 🍎

Person and email address for further information: Same as Section 3.1. 📧

Intended usage: COMMON 💯

Author/Change controller: Same as Section 3.1. 👑

3.4. Application/xml-external-parsed-entity Registration 🦋

MIME media type name: application

MIME subtype name: xml-external-parsed-entity

Mandatory parameters: none

Optional parameters: charset

The charset parameter here works exactly the same as it does for application/xml, as described in Section 3.2 ✨.

Encoding considerations: Same as Section 3.2. 🦋

Security considerations: See Section 10. 🔐

Interoperability considerations: Same as those for text/xml-external-parsed-entity, as described in Section 3.3 🤝.

Published specification: Same as text/xml, as described in Section 3.1. 📜

Applications which use this media type: Same as Section 3.1. 📱

Additional information:

Magic number(s): Same as Section 3.1. 🔮

File extension(s): .xml or .ent 📁

Macintosh File Type Code(s): "TEXT" 🍎

Person and email address for further information: Same as Section 3.1. 📧

Intended usage: COMMON 💯

Author/Change controller: Same as Section 3.1. 👑

3.5. Application/xml-dtd Registration 💜

MIME media type name: application

MIME subtype name: xml-dtd

Mandatory parameters: none

Optional parameters: charset

The charset parameter of application/xml-dtd is handled the same as that of application/xml, as described in Section 3.2 🎀.

Encoding considerations: Same as Section 3.2. 🦋

Security considerations: See Section 10. 🔐

Interoperability considerations: XML DTDs have proven to be interoperable across DTD authoring tools and XML browsers, among others 🤝🌈.

Published specification: Same as text/xml, as described in Section 3.1. 📜

Applications which use this media type: DTD authoring tools handle external DTD subsets as well as external parameter entities 🛠️. XML browsers may also access external DTD subsets and external parameter entities 🌐.

Additional information:

Magic number(s): Same as Section 3.1. 🔮

File extension(s): .dtd or .mod 📁

Macintosh File Type Code(s): "TEXT" 🍎

Person and email address for further information: Same as Section 3.1. 📧

Intended usage: COMMON 💯

Author/Change controller: Same as Section 3.1. 👑

3.6. Summary 📝

The following list applies to text/xml, text/xml-external-parsed-entity, and XML-based media types under the top-level type "text" that define the charset parameter according to this specification:

  • Charset parameter is strongly recommended. 💖
  • If the charset parameter is not specified, the default is "us-ascii". The default of "iso-8859-1" in HTTP is explicitly overridden. 🙅‍♀️
  • No error handling provisions. 🤷‍♀️
  • An encoding declaration, if present, is irrelevant, but when saving a received resource as a file, the correct encoding declaration SHOULD be inserted. 📁

The next list applies to application/xml, application/xml-external-parsed-entity, application/xml-dtd, and XML-based media types under top-level types other than "text" that define the charset parameter according to this specification:

  • Charset parameter is strongly recommended, and if present, it takes precedence. 👑
  • If the charset parameter is omitted, conforming XML processors MUST follow the requirements in section 4.3.3 of [XML]. 🔥

4. The Byte Order Mark (BOM) and Conversions to/from the UTF-16 Charset 🔮

Section 4.3.3 of [XML] specifies that XML MIME entities in the charset "utf-16" MUST begin with a byte order mark (BOM), which is a hexadecimal octet sequence 0xFE 0xFF (or 0xFF 0xFE, depending on endian). The XML Recommendation further states that the BOM is an encoding signature, and is not part of either the markup or the character data of the XML document 🧾.

Due to the presence of the BOM, applications that convert XML from "utf-16" to a non-Unicode encoding MUST strip the BOM before conversion ✂️. Similarly, when converting from another encoding into "utf-16", the BOM MUST be added after conversion is complete 🎀.

In addition to the charset "utf-16", [RFC2781] introduces "utf-16le" (little endian) and "utf-16be" (big endian) as well 💫. The BOM is prohibited for these charsets. When an XML MIME entity is encoded in "utf-16le" or "utf-16be", it MUST NOT begin with the BOM, but it SHOULD contain an encoding declaration 🚫. Conversion from "utf-16" to "utf-16be" or "utf-16le", and conversion in the other direction, MUST strip or add the BOM, respectively 🔁.

5. Fragment Identifiers 🧩

Section 4.1 of [RFC2396] notes that the semantics of a fragment identifier (the part of a URI after a "#") is a property of the data resulting from a retrieval action, and that the format and interpretation of fragment identifiers is dependent on the media type of the retrieval result 🔗.

As of today, no established specifications define identifiers for XML media types 🙃. However, a working draft published by W3C, namely "XML Pointer Language (XPointer)", attempts to define fragment identifiers for text/xml and application/xml 🎯. The current specification for XPointer is available at http://www.w3.org/TR/xptr 🌐.

6. The Base URI 🏠

Section 5.1 of [RFC2396] specifies that the semantics of a relative URI reference embedded in a MIME entity is dependent on the base URI. The base URI is either (1) the base URI embedded in the MIME entity, (2) the base URI of the encapsulating MIME entity, (3) the URI used to retrieve the MIME entity, or (4) the application-dependent default base URI, where (1) has the highest precedence. [RFC2396] further specifies that the mechanism for embedding the base URI is dependent on the media type 📍.

As of today, no established specifications define mechanisms for embedding the base URI in XML MIME entities 😅. However, a Proposed Recommendation published by W3C, namely "XML Base", attempts to define such a mechanism for text/xml, application/xml, text/xml-external-parsed-entity, and application/xml-external-parsed-entity 🌟. The current specification for XML Base is available at http://www.w3.org/TR/xmlbase 🦋.

7. A Naming Convention for XML-Based Media Types ✨

okay so this section is basically saying: when you make a new XML-based media type, stick a +xml suffix on the end, no matter what the document is about 🎀. Then generic XML tools can work on a huge range of document types for basically no extra cost, using the registration frameworks that already exist 💅

The suffix wasn't part of the original MIME design, but this choice gives the most functionality with the least risk of interoperability problems or lack of future extensibility 🦋 The other options and why +xml won are in Appendix A, so go check that out if you're curious 🧚

XML keeps growing, and new document types are popping up fast 🌈 Lots of these would benefit from a more specific media type than text/xml or application/xml can give them, so expect a steady stream of new XML-based media types in the near future and beyond 💜

Specific types are a big deal, but every XML document shares common structures and syntax, and that's what makes common processing possible 🫶

Some areas where "generic" processing is useful:

  • Browsing - An XML browser can display any XML document with a provided [CSS] or [XSLT] style sheet, whatever the vocabulary of that document.
  • Editing - Any XML editor can read, modify, and save any XML document.
  • Fragment identification - XPointers (work in progress) can work with any XML document, whatever vocabulary it uses and whether or not it uses XPointer for its own fragment identification.
  • Hypertext linking - XLink (work in progress) hypertext linking is designed to connect any XML documents, regardless of vocabulary.
  • Searching - XML-oriented search engines, web crawlers, agents, and query tools should be able to read XML documents and extract the names and content of elements and attributes even if the tools are ignorant of the particular vocabulary used for elements and attributes.
  • Storage - XML-oriented storage systems, which keep XML documents internally in a parsed form, should similarly be able to process, store, and recreate any XML document.
  • Well-formedness and validity checking - An XML processor can confirm that any XML document is well-formed and that it is valid (i.e., conforms to its declared DTD or Schema).

When a new media type is introduced for an XML-based format, the name of the media type SHOULD end with +xml. This is the move that lets apps that can process XML generically spot that a MIME entity is supposed to be an XML document, double-check that by invoking an XML processor, and then process it accordingly 🔥 Apps may match XML MIME entities by comparing the subtype to the pattern */*+xml. (Of course, 4 of the 5 media types defined in this document, text/xml, application/xml, text/xml-external-parsed-entity, and application/xml-external-parsed-entity, also represent XML MIME entities while not conforming to the */*+xml pattern 💀)

NOTE: Section 14.1 of HTTP[RFC2616] does not support Accept headers of the form "Accept: /+xml" and so this header MUST NOT be used in this way. Instead, content negotiation[RFC2703] could potentially be used if an XML-based MIME type were needed.

Generic XML processing isn't always the right call for XML-based media types 🙈 Some authors may want their types to stay totally opaque, except to apps that are specifically built for that media type. By NOT following the +xml naming convention, those types can dodge generic XML processing. Generic processing will still be useful in lots of cases, though, including situations that are hard to predict ahead of time, so anyone registering a media type SHOULD use the +xml convention unless they have a particularly compelling reason not to 👑

The registration process for these media types is described in [RFC2048]. The registrar for the IETF tree will encourage new XML-based media type registrations in the IETF tree to follow this guideline. Registrars for other trees SHOULD follow this convention in order to ensure maximum interoperability of their XML-based documents. Similarly, media subtypes that do not represent XML MIME entities MUST NOT be allowed to register with a +xml suffix 🚫✨

7.1 Referencing

Registrations for new XML-based media types under the top-level type "text" SHOULD, in specifying the charset parameter and encoding considerations, define them as: "Same as [charset parameter / encoding considerations] of text/xml as specified in RFC 3023."

Registrations for new XML-based media types under top-level types other than "text" SHOULD, in specifying the charset parameter and encoding considerations, define them as: "Same as [charset parameter / encoding considerations] of application/xml as specified in RFC 3023."

The use of the charset parameter is STRONGLY RECOMMENDED, since this information can be used by XML processors to determine authoritatively the charset of the XML MIME entity 🎀

These registrations SHOULD specify that the XML-based media type being registered has all of the security considerations described in RFC 3023 plus any additional considerations specific to that media type 🔐

These registrations SHOULD also make reference to RFC 3023 in specifying magic numbers, fragment identifiers, base URIs, and use of the BOM 🌸

These registrations MAY reference the text/xml registration in RFC 3023 in specifying interoperability considerations, if these considerations are not overridden by issues specific to that media type 🦋

8. Examples 🍓

The examples below give the value of the MIME Content-type header and the XML declaration (which includes the encoding declaration) inside the XML MIME entity. For UTF-16 examples, the Byte Order Mark character is denoted as {BOM}, and the XML declaration is assumed to come at the beginning of the XML MIME entity, immediately following the BOM. Other MIME headers may be present, and the XML MIME entity may contain other data in addition to the XML declaration. The examples focus on the Content-type header and the encoding declaration for clarity 💖

8.1 Text/xml with UTF-8 Charset

Content-type: text/xml; charset="utf-8"

<?xml version="1.0" encoding="utf-8"?>

This is the recommended charset value for use with text/xml. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-8 encoded ✨

If sent using a 7-bit transport (e.g., SMTP[RFC0821]), the XML MIME entity MUST use a content-transfer-encoding of either quoted-printable or base64. For an 8-bit clean transport (e.g., 8BITMIME ESMTP or NNTP), or a binary clean transport (e.g., HTTP), no content-transfer-encoding is necessary 🫧

8.2 Text/xml with UTF-16 Charset

Content-type: text/xml; charset="utf-16"

{BOM}<?xml version='1.0' encoding='utf-16'?>

or

{BOM}<?xml version='1.0'?>

This is possible only when the XML MIME entity is transmitted via HTTP, which uses a MIME-like mechanism and is a binary-clean protocol, hence does not perform CR and LF transformations and allows NUL octets. As described in [RFC2781], the UTF-16 family MUST NOT be used with media types under the top-level type "text" except over HTTP (see section 19.4.1 of [RFC2616] for details) 😭

Since HTTP is binary clean, no content-transfer-encoding is necessary 🌈

8.3 Text/xml with UTF-16BE Charset

Content-type: text/xml; charset="utf-16be"

<?xml version='1.0' encoding='utf-16be'?>

Observe that the BOM does not exist. This is again possible only when the XML MIME entity is transmitted via HTTP 👀

8.4 Text/xml with ISO-2022-KR Charset

Content-type: text/xml; charset="iso-2022-kr"

<?xml version="1.0" encoding='iso-2022-kr'?>

This example shows text/xml with a Korean charset (e.g., Hangul) encoded following the specification in [RFC1557]. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as encoded per RFC 1557 🇰🇷

Since ISO-2022-KR has been defined to use only 7 bits of data, no content-transfer-encoding is necessary with any transport 💜

8.5 Text/xml with Omitted Charset

Content-type: text/xml

{BOM}<?xml version="1.0" encoding="utf-16"?>

or

{BOM}<?xml version="1.0"?>

This example shows text/xml with the charset parameter omitted. In this case, MIME and XML processors MUST assume the charset is "us-ascii", the default charset value for text media types specified in [RFC2046]. The default of "us-ascii" holds even if the text/xml entity is transported using HTTP 🙃

Omitting the charset parameter is NOT RECOMMENDED for text/xml. For example, even if the contents of the XML MIME entity are UTF-16 or UTF-8, or the XML MIME entity has an explicit encoding declaration, XML and MIME processors MUST assume the charset is "us-ascii" 💀

8.6 Application/xml with UTF-16 Charset

Content-type: application/xml; charset="utf-16"

{BOM}<?xml version="1.0" encoding="utf-16"?>

or

{BOM}<?xml version="1.0"?>

This is a recommended charset value for use with application/xml. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-16 encoded 🧚

If sent using a 7-bit transport (e.g., SMTP) or an 8-bit clean transport (e.g., 8BITMIME ESMTP or NNTP), the XML MIME entity MUST be encoded in quoted-printable or base64. For a binary clean transport (e.g., HTTP), no content-transfer-encoding is necessary ✨

8.7 Application/xml with UTF-16BE Charset

Content-type: application/xml; charset="utf-16be"

<?xml version='1.0' encoding='utf-16be'?>

Observe that the BOM does not exist. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-16BE encoded 🎀

8.8 Application/xml with ISO-2022-KR Charset

Content-type: application/xml; charset="iso-2022-kr"

<?xml version="1.0" encoding="iso-2022-kr"?>

This example shows application/xml with a Korean charset (e.g., Hangul) encoded following the specification in [RFC1557]. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as encoded per RFC 1557, independent of whether the XML MIME entity has an internal encoding declaration (this example does show such a declaration, which agrees with the charset parameter) 🫶

Since ISO-2022-KR has been defined to use only 7 bits of data, no content-transfer-encoding is necessary with any transport 🌸

8.9 Application/xml with Omitted Charset and UTF-16 XML MIME Entity

Content-type: application/xml

{BOM}<?xml version='1.0' encoding="utf-16"?>

or

{BOM}<?xml version='1.0'?>

For this example, the XML MIME entity begins with a BOM. Since the charset has been omitted, a conforming XML processor follows the requirements of [XML], section 4.3.3. Specifically, the XML processor reads the BOM, and thus knows deterministically that the charset is UTF-16 🔍

An XML-unaware MIME processor SHOULD make no assumptions about the charset of the XML MIME entity 🙈

8.10 Application/xml with Omitted Charset and UTF-8 Entity 🎀

Content-type: application/xml

<?xml version='1.0'?>

okay so here the charset parameter is missing and there's no BOM 🙈 With no BOM, the XML processor follows the rules in section 4.3.3 of [XML], and it can optionally use the trick in Appendix F of [XML] (which is non-normative, so it's a bonus, not a rule) to figure out that the charset is UTF-8 💅. The XML MIME entity has no encoding declaration, but since it's UTF-8 it's still a totally valid XML MIME entity. ✨ slay.

An XML-unaware MIME processor SHOULD make no assumptions about the charset of the XML MIME entity. 🦋

8.11 Application/xml with Omitted Charset and Internal Encoding Declaration 🌸

Content-type: application/xml

<?xml version='1.0' encoding="iso-10646-ucs-4"?>

this one also leaves out the charset parameter and has no BOM, BUT the XML MIME entity has its own encoding declaration inside it that says what charset it's using 🧚. So the XML processor follows section 4.3.3 of [XML] and can optionally apply the Appendix F (non-normative) mechanism of [XML], and it works out the charset from there. In this example, that's UCS-4 💜.

An XML-unaware MIME processor SHOULD make no assumptions about the charset of the XML MIME entity. 🫶

8.12 Text/xml-external-parsed-entity with UTF-8 Charset 💖

Content-type: text/xml-external-parsed-entity; charset="utf-8"

<?xml encoding="utf-8"?>

this is the recommended charset value for text/xml-external-parsed-entity, so it's giving main character energy 👑. Because the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-8 encoded. No skipping that part, bestie 😭.

If it's sent over a 7-bit transport (like SMTP), the XML MIME entity MUST use a content-transfer-encoding of either quoted-printable or base64. 🍓 For an 8-bit clean transport (like 8BITMIME ESMTP or NNTP), or a binary clean transport (like HTTP), no content-transfer-encoding is necessary ✨.

8.13 Application/xml-external-parsed-entity with UTF-16 Charset 🌈

Content-type: application/xml-external-parsed-entity;
 charset="utf-16"

{BOM}<?xml encoding="utf-16"?>

or

{BOM}<?xml?>

this is a recommended charset value for application/xml-external-parsed-entity 🎀. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-16 encoded, periodt 💅.

If it's sent over a 7-bit transport (like SMTP) or an 8-bit clean transport (like 8BITMIME ESMTP or NNTP), the XML MIME entity MUST be encoded in quoted-printable or base64. For a binary clean transport (like HTTP), no content-transfer-encoding is necessary 🦋.

8.14 Application/xml-external-parsed-entity with UTF-16BE Charset 🧚

Content-type: application/xml-external-parsed-entity;
 charset="utf-16be"

<?xml encoding="utf-16be"?>

since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-16BE encoded. Clean and simple, iconic 💜.

8.15 Application/xml-dtd 🍓

Content-type: application/xml-dtd; charset="utf-8"

<?xml encoding="utf-8"?>

charset "utf-8" is a recommended charset value for application/xml-dtd 🌸. Since the charset parameter is provided, MIME and XML processors MUST treat the enclosed entity as UTF-8 encoded. ✨

8.16 Application/mathml+xml 🌟

Content-type: application/mathml+xml

<?xml version="1.0" ?>

MathML documents are XML documents whose content describes mathematical information, as defined by [MathML] 🧮. As a format based on XML, MathML documents SHOULD use the '+xml' suffix convention in their MIME content-type identifier. 💅 However, no content type has yet been registered for MathML, so this media type should not be used until that registration has been completed. not me waiting on the paperwork 😭.

8.17 Application/xslt+xml 🎨

Content-type: application/xslt+xml

<?xml version="1.0" ?>

Extensible Stylesheet Language (XSLT) documents are XML documents whose content describes stylesheets for other XML documents, as defined by [XSLT] 🦋. As a format based on XML, XSLT documents SHOULD use the '+xml' suffix convention in their MIME content-type identifier. However, no content type has yet been registered for XSLT, so this media type should not be used until that registration has been completed 🫶.

8.18 Application/rdf+xml 🌈

Content-type: application/rdf+xml

<?xml version="1.0" ?>

RDF documents identified with this MIME type are XML documents whose content describes metadata, as defined by [RDF] 💜. As a format based on XML, RDF documents SHOULD use the '+xml' suffix convention in their MIME content-type identifier. Still no registered content type for RDF though, so this media type should not be used until that's finished 🌸.

8.19 Image/svg+xml 🖼️

Content-type: image/svg+xml

<?xml version="1.0" ?>

Scalable Vector Graphics (SVG) documents are XML documents whose content describes graphical information, as defined by [SVG] ✨. As a format based on XML, SVG documents SHOULD use the '+xml' suffix convention in their MIME content-type identifier. However, no content type has been registered for SVG yet, so this media type should not be used until registration is complete 🍓.

8.20 INCONSISTENT EXAMPLE: Text/xml with UTF-8 Charset 🚨

Content-type: text/xml; charset="utf-8"

<?xml version="1.0" encoding="iso-8859-1"?>
🚨 this one's the cautionary tale, so pay attention 🚨

since the charset parameter is provided in the Content-Type header, MIME and XML processors MUST treat the enclosed entity as UTF-8 encoded. That means the "iso-8859-1" encoding MUST be ignored. 😭 Basically the header wins, and the declaration gets thrown out.

Processors generating XML MIME entities MUST NOT label conflicting charset information between the MIME Content-Type and the XML declaration. 🙅‍♀️ No contradictions, no drama, ever 💅.

9. IANA Considerations 📋

As described in Section 7, this document updates the [RFC2048] registration process for XML-based MIME types. 🌷 So the registration rules changed, and the paperwork follows the new way 🧚.

10. Security Considerations 🔐

okay this section is LONG and it's super serious, so let's gooo 🫣.

XML, as a subset of SGML, has all of the same security considerations as specified in [RFC1874], and likely more, due to its expected ubiquitous deployment 🌍. Like, it's everywhere, so the risks are everywhere too 😬.

To paraphrase section 3 of RFC 1874: XML MIME entities contain information to be parsed and processed by the recipient's XML system. These entities may contain, and such systems may permit, explicit system level commands to be executed while processing the data. ⚠️ To the extent that an XML system will execute arbitrary command strings, recipients of XML MIME entities may be at risk. In general, it may be possible to specify commands that perform unauthorized file operations or make changes to the display processor's environment that affect subsequent operations 💀.

In general, any information stored outside of the direct control of the user, including CSS style sheets, XSL transformations, entity declarations, and DTDs, can be a source of insecurity, by either obvious or subtle means 👀. For example, a tiny "whiteout attack" modification made to a "master" style sheet could make words in critical locations disappear in user documents, without directly modifying the user document or the stylesheet it references. 🫠 Thus, the security of any XML document is vitally dependent on all of the documents recursively referenced by that document. so every link in the chain matters 🔗.

The entity lists and DTDs for XHTML 1.0 [XHTML], for instance, are likely to be a commonly used set of information. Many developers will use and trust them, few of whom will know much about the level of security on the W3C's servers, or on any similarly trusted repository 🙈.

The simplest attack involves adding declarations that break validation. Adding extraneous declarations to a list of character entities can effectively "break the contract" used by documents. A tiny change that produces a fatal error in a DTD could halt XML processing on a large scale 💥. Extraneous declarations are fairly obvious, but more sophisticated tricks, like changing attributes from being optional to required, can be difficult to track down. Perhaps the most dangerous option available to crackers is redefining default values for attributes: e.g., if developers have relied on defaulted attributes for security, a relatively small change might expose enormous quantities of information 😱.

Apart from the structural possibilities, another option, "entity spoofing," can be used to insert text into documents, vandalizing and perhaps conveying an unintended message. Because XML 1.0 permits multiple entity declarations, and the first declaration takes precedence, it's possible to insert malicious content where an entity is used, such as by inserting the full text of Winnie the Pooh in every occurrence of &mdash; 🍯📖.

Use of the digital signatures work currently underway by the xmldsig working group may eventually ameliorate the dangers of referencing external documents not under one's own control 🔏.

Use of XML is expected to be varied and widespread. XML is under scrutiny by a wide range of communities for use as a common syntax for community-specific metadata. For example, the Dublin Core [RFC2413] group is using XML for document metadata, and a new effort has begun that is considering use of XML for medical information 🩺. Other groups view XML as a mechanism for marshalling parameters for remote procedure calls. More uses of XML will undoubtedly arise 🌱.

Security considerations will vary by domain of use. For example, XML medical records will have much more stringent privacy and security considerations than XML library metadata. Similarly, use of XML as a parameter marshalling syntax necessitates a case by case security review 🔍.

XML may also have some of the same security concerns as plain text. Like plain text, XML can contain escape sequences that, when displayed, have the potential to change the display processor environment in ways that adversely affect subsequent operations. Possible effects include, but are not limited to, locking the keyboard, changing display parameters so subsequent displayed text is unreadable, or even changing display parameters to deliberately obscure or distort subsequent displayed material so that its meaning is lost or altered 🌀. Display processors SHOULD either filter such material from displayed text or else make sure to reset all important settings after a given display operation is complete. 🧹

Some terminal devices have keys whose output, when pressed, can be changed by sending the display processor a character sequence. If this is possible, the display of a text object containing such character sequences could reprogram keys to perform some illicit or dangerous action when the key is subsequently pressed by the user 😨. In some cases, not only can keys be programmed, they can be triggered remotely, making it possible for a text display operation to directly perform some unwanted action. As such, the ability to program keys SHOULD be blocked either by filtering or by disabling the ability to program keys entirely. 🚫⌨️

Note that it is also possible to construct XML documents that make use of what XML terms "entity references" (using the XML meaning of the term "entity" as described in Section 2), to construct repeated expansions of text. Recursive expansions are prohibited by [XML] and XML processors are required to detect them. However, even non-recursive expansions may cause problems with the finite computing resources of computers, if they are performed many times. 🧠💻 the vibes are: don't let the expansions get out of hand, bestie 🫶.

References ✨

  • [ASCII] "US-ASCII. Coded Character Set -- 7-Bit American Standard Code for Information Interchange", ANSI X3.4-1986, 1986.
  • [CSS] Bos, B., Lie, H.W., Lilley, C. and I. Jacobs, "Cascading Style Sheets, level 2 (CSS2) Specification", World Wide Web Consortium Recommendation REC-CSS2, May 1998, <http://www.w3.org/TR/REC-CSS2/>.
  • [ISO8859] "ISO-8859. International Standard -- Information Processing -- 8-bit Single-Byte Coded Graphic Character Sets -- Part 1: Latin alphabet No. 1, ISO-8859-1:1987", 1987.
  • [MathML] Ion, P. and R. Miner, "Mathematical Markup Language (MathML) 1.01", World Wide Web Consortium Recommendation REC-MathML, July 1999, <http://www.w3.org/TR/REC-MathML/>.
  • [PNG] Boutell, T., "PNG (Portable Network Graphics) Specification", World Wide Web Consortium Recommendation REC-png, October 1996, <http://www.w3.org/TR/REC-png>.
  • [RDF] Lassila, O. and R.R. Swick, "Resource Description Framework (RDF) Model and Syntax Specification", World Wide Web Consortium Recommendation REC-rdf-syntax, February 1999, <http://www.w3.org/TR/REC-rdf-syntax/>.
  • [RFC0821] Postel, J., "Simple Mail Transfer Protocol", STD 10, RFC 821, August 1982.
  • [RFC0977] Kantor, B. and P. Lapsley, "Network News Transfer Protocol", RFC 977, February 1986.
  • [RFC1557] Choi, U., Chon, K. and H. Park, "Korean Character Encoding for Internet Messages", RFC 1557, December 1993.
  • [RFC1652] Klensin, J., Freed, N., Rose, M., Stefferud, E. and D. Crocker, "SMTP Service Extension for 8bit-MIMEtransport", RFC 1652, July 1994.
  • [RFC1874] Levinson, E., "SGML Media Types", RFC 1874, December 1995.
  • [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996.
  • [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types", RFC 2046, November 1996.
  • [RFC2048] Freed, N., Klensin, J. and J. Postel, "Multipurpose Internet Mail Extensions (MIME) Part Four: Registration Procedures", RFC 2048, November 1996.
  • [RFC2060] Crispin, M., "Internet Message Access Protocol - Version 4rev1", RFC 2060, December 1996.
  • [RFC2077] Nelson, S., Parks, C. and Mitra, "The Model Primary Content Type for Multipurpose Internet Mail Extensions", RFC 2077, January 1997.
  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC2130] Weider, C., Preston, C., Simonsen, K., Alvestrand, H., Atkinson, R., Crispin, M. and P. Svanberg, "The Report of the IAB Character Set Workshop held 29 February - 1 March, 1996", RFC 2130, April 1997.
  • [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 10646", RFC 2279, January 1998.
  • [RFC2376] Whitehead, E. and M. Murata, "XML Media Types", RFC 2376, July 1998.
  • [RFC2396] Berners-Lee, T., Fielding, R. and L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax.", RFC 2396, August 1998.
  • [RFC2413] Weibel, S., Kunze, J., Lagoze, C. and M. Wolf, "Dublin Core Metadata for Resource Discovery", RFC 2413, September 1998.
  • [RFC2445] Dawson, F. and D. Stenerson, "Internet Calendaring and Scheduling Core Object Specification (iCalendar)", RFC 2445, November 1998.
  • [RFC2518] Goland, Y., Whitehead, E., Faizi, A., Carter, S. and D. Jensen, "HTTP Extensions for Distributed Authoring -- WEBDAV", RFC 2518, February 1999.
  • [RFC2616] Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P. and T. Berners-Lee, "Hypertext Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.
  • [RFC2629] Rose, M., "Writing I-Ds and RFCs using XML", RFC 2629, June 1999.
  • [RFC2703] Klyne, G., "Protocol-independent Content Negotiation Framework", RFC 2703, September 1999.
  • [RFC2781] Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646", RFC 2781, Februrary 2000.
  • [RFC2801] Burdett, D., "Internet Open Trading Protocol - IOTP Version 1.0", RFC 2801, April 2000.
  • [SGML] International Standard Organization, "Information Processing -- Text and Office Systems -- Standard Generalized Markup Language (SGML)", ISO 8879, October 1986.
  • [SVG] Ferraiolo, J., "Scalable Vector Graphics (SVG)", World Wide Web Consortium Candidate Recommendation SVG, November 2000, <http://www.w3.org/TR/SVG>.
  • [XHTML] Pemberton, S. and et al, "XHTML 1.0: The Extensible HyperText Markup Language", World Wide Web Consortium Recommendation xhtml1, January 2000, <http://www.w3.org/TR/xhtml1>.
  • [XML] Bray, T., Paoli, J., Sperberg-McQueen, C.M. and E. Maler, "Extensible Markup Language (XML) 1.0 (Second Edition)", World Wide Web Consortium Recommendation REC-xml, October 2000, <http://www.w3.org/TR/REC-xml>.
  • [XSLT] Clark, J., "XSL Transformations (XSLT) Version 1.0", World Wide Web Consortium Recommendation xslt, November 1999, <http://www.w3.org/TR/xslt>.

Authors' Addresses 💌

MURATA Makoto (FAMILY Given)
IBM Tokyo Research Laboratory
1623-14, Shimotsuruma
Yamato-shi, Kanagawa-ken  242-8502
Japan

Phone: +81-46-215-4678
EMail: mmurata@trl.ibm.co.jp
Simon St.Laurent
simonstl.com
1259 Dryden Road
Ithaca, New York  14850
USA

EMail: simonstl@simonstl.com
URI:   http://www.simonstl.com/
Dan Kohn
Skymoon Ventures
3045 Park Boulevard
Palo Alto, California  94306
USA

Phone: +1-650-327-2600
EMail: dan@dankohn.com
URI:   http://www.dankohn.com/

Appendix A. Why Use the '+xml' Suffix for XML-Based MIME Types? 🎀

Okay so, the original MIME architecture never even thought about suffixes 🙈 but the '+xml' suffix is still considered to give the most functionality with the least potential for interoperability problems or lack of future extensibility. 💅 The alternatives, and why we didn't pick them, are below. ✨

A.1 Why not just use text/xml or application/xml and let the XML processor dispatch to the correct application based on the referenced DTD?

text/xml and application/xml are still super useful, especially for document-oriented apps that pair XML with a stylesheet to present the data. 📄 But XML is also used to define totally new data types, and an XML-based format like image/svg+xml fits the MIME media type definition exactly as well as image/png[PNG] does. 🦋 (Note that image/svg+xml is not yet registered.) Yes, MIME processors that are also XML processors get extra features, but XML-based media types, even when treated as opaque, non-XML media types, are just as useful as any other media type and should be treated as such. 💖

Since MIME dispatchers work off of the MIME type, labeling discrete media types with text/xml or application/xml will hinder correct dispatching and general interoperability. 😭 And finally, lots of XML documents use neither DTDs nor namespaces, yet they are perfectly legal XML. 🧚

A.2 Why not create a new subtree (e.g., image/xml.svg) to represent XML MIME types?

The subtree a media type is registered under (IETF, vendor (/vnd.), or personal (/prs.); see [RFC2048] for details) is completely orthogonal to whether the type uses XML syntax or not. 🌸 The suffix approach lets XML document types be identified within any subtree. The vendor subtree, for example, is likely to include a huge number of XML-based document types, so using a suffix instead of a separate subtree means those types can stay in the same spot in the MIME tree they'd have occupied if they weren't XML-based. 🍓 Iconic. 👑

A.3 Why not create a new top-level MIME type for XML-based media types?

The top-level MIME type (e.g., model/[RFC2077]) tells you what kind of content the type is, not what syntax it uses. 🌈 For example, agents using image/ to signal they accept any image format should absolutely be given access to image/svg+xml, which is in every way a standard image subtype. It just happens to use XML to describe its syntax. ✨ The two aspects of the media type are completely orthogonal. 🫶

XML-based data types will most likely be registered in ALL top-level categories. Potential, though currently unregistered, examples could include application/mathml+xml[MathML] and image/svg+xml[SVG]. 💜

A.4 Why not just have the MIME processor 'sniff' the content to determine whether it is XML?

So instead of explicitly labeling XML-based media types, the processor could look inside each type and check whether it's XML. ✨ It could also cache a list of XML-based media types. 🧠

Ngl, this might work fine for some mail apps, but it would fail completely in lots of other uses of MIME. 💀 Take an XML-based web crawler: it would have no way to know whether a file is XML except to fetch it and check. Same deal in some IMAP4[RFC2060] mail apps, where the client fetches the MIME type as part of the message structure and then decides whether to fetch the MIME entity. Making those fetches just to figure out whether the type is XML could cost a lot of bandwidth and latency. 😩

Sniffing XML also isn't as simple as it sounds, bestie. 🙈 DOCTYPE declarations aren't required, and they can show up pretty deep into a document under certain unpreventable circumstances. (E.g., the XML declaration, comments, and processing instructions can take up space before the DOCTYPE declaration.) Even sniffing the DOCTYPE isn't totally reliable, thanks to a bunch of issues with default values for namespaces within external DTDs and overrides inside the internal DTD. 🥴 And finally, the variety of possible character encodings (which XML gives you tools to deal with) makes reliable sniffing even less likely. 🔥

A.5 Why not use a MIME parameter to specify that a media type uses XML syntax? 🤔

okay so what if we just used a parameter to say "hey, this is XML"? For example, one could use Content-Type: application/iotp; alternate-type=text/xml or Content-Type: application/iotp; syntax=xml.

Section 5 of [RFC2045] says that "Parameters are modifiers of the media subtype, and as such do not fundamentally affect the nature of the content". 💅 But XML-based media types are ALWAYS XML by their nature, bestie. Parameters, as they've been defined in the MIME architecture, are never invariant across all instantiations of a media type. 😭 So a parameter can't be the thing that guarantees it.

More practically 🫶, very few if any MIME dispatchers and other MIME agents support dispatching off of a parameter. Receiving agents will need an update either way to support (or fall back to) generic XML processing, but it's been suggested that it's easier to do this when you're acting off the media type instead of a parameter. The bigger deal is that sending agents need no update at all to properly tag an image as image/svg+xml, but few if any sending agents currently support always tagging certain content types with a parameter. 🙈

A.6 How about labeling with parameters in the other direction (e.g., application/xml; Content-Feature=iotp)? 🎀

this one fails in the simplest case: a user who knows nothing about XML and has no XML-capable MIME dispatcher. Their dispatcher is likely to send the content to an XML processing application, when the correct default behavior should be to send it to the application responsible for the content type (e.g., an ecommerce engine for application/iotp+xml[RFC2801], once this media type is registered). 💀

Even if the user had already installed the right application (like that ecommerce engine), and the install had updated the MIME registry, lots of operating system level MIME registries, like .mailcap in Unix and HKEY_CLASSES_ROOT in Windows, don't currently support dispatching off a parameter, and they can't easily be upgraded to do it. And even if the operating system were upgraded, each MIME dispatcher would also separately need an upgrade. 😩

A.7 How about a new superclass MIME parameter that is defined to apply to all MIME types (e.g., Content-Type: application/iotp; $superclass=xml)? 👑

this one mashes together the problems from Appendix A.5 and Appendix A.6, so it's a double whammy.

Say the sender attaches an image/svg+xml file to a message and includes the instructions "Please copy the French text on the road sign". Someone with an XML-aware MIME client and an XML browser, but no support for SVG, can still probably open the file and copy the text. 🥹 With superclasses, though, the sender has to add superclass support to her existing mailer AND the receiver has to add superclass support to his before this transaction can work correctly.

And if the receiver comes to rely on the superclass tag being present, and applications get deployed relying on that tag (as always seems to happen), then only upgraded senders will be able to interoperate with those receiving applications. 😭

A.8 What about adding a new parameter to the Content-Disposition header or creating a new Content-Structure header to indicate XML syntax? 🧚

this has nearly identical problems to Appendix A.7. It requires both senders and receivers to be upgraded, and few if any operating systems and MIME dispatchers support working off of anything other than the MIME type. ngl, it's the same mess in a different outfit. 💅

A.9 How about a new Alternative-Content-Type header? 🌸

this is better than Appendix A.8, because no extra functionality needs to be added to a MIME registry to dispatch information that isn't a standard content type. Still, it requires both sender and receiver to be upgraded, and it will also fail in many cases (e.g., web hosting to an outsourced server). In those cases the user can set MIME types (often through implicit mapping to file extensions), but has no way of adding arbitrary HTTP headers. 🙃

A.10 How about using a conneg tag instead (e.g., accept-features: (syntax=xml))? 🦋

when the conneg protocol is fully defined, this may potentially be a reasonable thing to do. But given the limited current state of conneg[RFC2703] development, it is not a credible replacement for a MIME-based solution. not yet, anyway. 🫠

A.11 How about a third-level content-type, such as text/xml/rdf? 🍓

MIME explicitly defines two levels of content type: the top-level for the kind of content, and the second-level for the specific media type. [RFC2048] extends this in an interoperable way by using prefixes to specify separate trees for IETF, vendor, and personal registrations. This specification also extends the two-level type by using the +xml suffix. In both cases, processors that don't know about these later specifications treat them as opaque and keep on interoperating. 🥰 By contrast, adding a third-level type would break the current MIME architecture and cause numerous interoperability failures. absolutely not. 🚫

A.12 Why use the plus ('+') character for the suffix '+xml'? ✨

As specified in Section 5.1 of [RFC2045], a tspecial can't be used:

      tspecials :=
      "(" / ")" / "<" / ">" / "@" /
      "," / ";" / ":" / "\" / <">
      "/" / "[" / "]" / "?" / "="

It was thought that "." wouldn't be a good choice, since it's already used as an additional hierarchy delimiter. Also, "*" has a common wildcard meaning, and "-" and "_" are common word separators and easily confused. The characters %'#&` are frequently used for quoting or comments, so they aren't ideal either. 🙅‍♀️

That leaves: ~!$^+{}|

Note that "-" is used heavily in the current registry. "$" and "_" are used once each. The others are currently unused. 📋

It was thought that '+' expressed the semantics that a MIME type can be treated (for example) as both scalable vector graphics AND ALSO as XML. It is both simultaneously. 👯‍♀️🌈

A.13 What is the semantic difference between application/foo and application/foo+xml? 💖

MIME processors that don't know about XML will treat the +xml suffix as completely opaque, so it is essential that no extra semantics get assigned to its presence. Therefore, application/foo and application/foo+xml SHOULD be treated as completely independent media types. 🙌 Although, for example, text/calendar+xml could be an XML version of text/calendar[RFC2445], it's possible that this (hypothetical) new media type would include new semantics as well as new syntax. And in any case, there would be many applications that support text/calendar but haven't been upgraded to support text/calendar+xml yet. 🗓️

A.14 What happens when an even better markup language (e.g., EBML) is defined, or a new category of data? 🔮

In the ten years that MIME has existed, XML is the first generic data format that has seemed to justify special treatment, so it's hoped that no further suffixes will be necessary. However, if some are defined later, and these documents were also XML, they would need to specify that the +xml suffix is always the outermost suffix (e.g., application/foo+ebml+xml, not application/foo+xml+ebml). If they weren't XML, then they would use a regular suffix (e.g., application/foo+ebml). 🧩

A.15 Why must I use the '+xml' suffix for my new XML-based media type? 🌟

you don't have to! But unless you have a good reason to explicitly disallow generic XML processing, you should use the suffix so you don't curtail the options of future users and developers. 🫶

Whether the inventors of a media type, today, design it for dispatch to generic XML processing machinery (and most won't) isn't the critical issue. The core notion is that knowing a media type happens to use XML syntax opens the door to unanticipated kinds of processing beyond what its inventors pictured, and on that basis, identifying such encoding is a good and useful thing. 🔍

Developers of new media types are often tightly focused on one type of processing that meets current needs. But there's no need to rule out generic processing too, which could make your media type more valuable over time. It is believed that registering with the +xml suffix will cause no interoperability problems whatsoever, while it may enable significant new functionality and interoperability now and in the future. So the conservative approach is to include the +xml suffix. 🎀

Appendix B. Changes from RFC 2376 🦋

There are numerous and significant differences between this specification and [RFC2376], which it obsoletes. This appendix summarizes only the major differences. 📝

First, text/xml-external-parsed-entity and application/xml-external-parsed-entity are added as media types for external parsed entities, and text/xml and application/xml are now prohibited. 🚫

Second, application/xml-dtd is added as a media type for external DTD subsets and external parameter entities, and text/xml and application/xml are now prohibited. 🚫

Third, "utf-16le" and "utf-16be" are added. RFC 2781 has introduced these BOM-less variations of the UTF-16 family. 🔤

Fourth, a naming convention (+xml) for XML-based media types has been added, which also updates [RFC2048] as described in Section 7. By following this convention, an XML-based media type can be easily recognized as such. 🏷️

Appendix C. Acknowledgements 🫶

This document reflects the input of numerous participants to the ietf-xml-mime@imc.org mailing list, though any errors are the responsibility of the authors. Special thanks to:

Mark Baker, James Clark, Dan Connolly, Martin Duerst, Ned Freed, Yaron Goland, Rick Jelliffe, Larry Masinter, David Megginson, Keith Moore, Chris Newman, Gavin Nicol, Marshall Rose, Jim Whitehead and participants of the XML activity at the W3C. 💜🌈

Copyright (C) The Internet Society (2001). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌸

Funding for the RFC Editor function is currently provided by the Internet Society. 💖

📦 where this page comes from