11595

There are many "standards" for the JSON content type:

application/json
application/x-javascript
text/javascript
text/x-javascript
text/x-json

Which one do I use, and where? I assume security and browser support issues are a factor.

Related: What MIME type if JSON is being returned by a REST API?

0

39 Answers 39

1
2
22

The most common MIME type is application/json. Here is a list of all JSON content types:

  • Content-Type: application/json - JSON
  • Content-Type: text/x-json - JSON before application/json got officially registered.
  • Content-Type: application/javascript - JSON-P
  • Content-Type: application/x-javascript - JavaScript

Obsolete Types:

  • Content-Type: text/javascript - JavaScript but obsolete. Older Internet Explorer versions used to use it for HTML attributes.
  • Content-Type: text/x-javascript - JavaScript Media Types, but obsolete

Additional References:

RFC4627 - The application/json Media Type for JavaScript Object Notation (JSON)

2
15

For specifying the interesting JSON result, you add "application/json" in your request header like below:

"Accept:application/json" is a desired response format.

"Content-Type:application/json" specifies the content format of your request, but sometimes you specify both application/json and application/xml, but the quality of these might be different. Which server will send back the different response formats, look at the example:

Accept:application/json;q=0.4,application/xml;q=8

This will return XML, because XML has higher quality.

1
  • If I may start an argument here: The accept header in the request does not make the server reply in that format. As you said, it's the desired format. The q qualifier is a wieghtage. The server app can go ahead and reply in whatever format it desires if it doesn't do as the request says. Along the same vein, if the server app only supports xml, specifying json won't do any auto-convert; you'll get an xml response. Commented Nov 29, 2019 at 5:26
15

As you may have to use these more frequently, always try to remember these three content types even though there are many content types:

  • Content-Type: application/json
  • Content-Type: application/xml
  • Content-Type: text/html
1
  • 7
    Don't forget text/plain
    – jpaugh
    Commented Aug 20, 2019 at 15:44
15

To complement the previous the answers, the MIME type for JSON linked data (JSON-LD) according to W3C is:

application/ld+json

Type name: application

Subtype name: ld+json

Additionally, from the same source:

File extension(s):

.jsonld

14

The proper current standard is application/json. While the default encoding is UTF-8, it is worth mentioning that it could also be UTF-16 or UTF-32. When JSON is written in UTF-16 or UTF-32, binary content-transfer-encoding must be used.

There is more information about JSON in RFC 4627: The application/json Media Type for JavaScript Object Notation (JSON)

More information on binary transfer encoding is on 5. The Content-Transfer-Encoding Header Field (RFC 1341).

10

As some research,

The most common MIME type is

application/json

Let's see a example to differentiate with JSON and JavaScript.

  • application/json

It is used when it is not known how this data will be used. When the information is to be just extracted from the server in JSON format, it may be through a link or from any file, in that case, it is used.

For example-

<?php

    header('Content-type:application/json');

    $directory = [
            ['Id' => 1, 'Name' => 'this'],
            ['Id' => 2, 'Name' => 'is'],
            ['Id' => 3, 'Name' => 'Stack Overflow'],
        ];

    // Showing the JSON data

    echo json_encode($directory);
?>

The output is,

[{"Id":1, "Name":"this"}, {"Id":2, "Name":"is"}, {"Id":3, "Name":"Stack Overflow"}]

  • application/javascript

It is used when the use of the data is predefined. It is used by applications in which there are calls by the client-side Ajax applications. It is used when the data is of type JSON-P or JSONP.

For example

<?php

    header('Content-type:application/javascript');

    $dir = [
            ['Id' => 1, 'Name' => 'this' ],
            ['Id' => 2, 'Name' => 'is'],
            ['Id' => 3, 'Name' => 'Stack Overflow'],
    ];

    echo "Function_call(" . json_encode($dir) . ");";
?>

The output is,

Function_call([{"Id":1, "Name":"this"}, {"Id":2, "Name":"is"}, {"Id":3, "Name":"Stack Overflow"}])

And for other MIME types, see the full detail in MIME types (IANA media types).

2
8

A part of your question is relevant to me as I just came across it.

A third-party provider is providing a REST service that is used by multiple clients. It's a straight-forward REST called with query parameters that returns a well-formed JSON. I have tested it with PHP and Java where it worked as expected.

My client uses Oracle Service Bus as a gateway between his application server and the Internet. When I made the OSB service, it crashed with an Invalid message format error. Turned out that the content-type being returned was text/html. OSB treats responses as per this header; converting between text, XML and JSON. In this case, the response was JSON but the header didn't say so. Contacting the provider, I got the reply: "We're not going to change it as it doesn't effect anyone else".

The Content-Type header specifies what the content should be, not what it actually is. That is to say, in your consuming program, it's up to you to check or ignore it and process the content in any manner. Another example, you can return GIF data but specify the content type as JSON, then go ahead and ignore the header and read the image data. This won't hurt your program, but may hurt others.

Moral of the story: Play nice.

7

It depends on the point of view.

If you are the client sending a request, then application/json is the right choice.

But if you are the server receiving a request, you have to be prepared, that the client may also send the encoding. So application/json and application/json; charset=utf-8 are valid.

The media type is the same in both cases. But the content type differs.

1

The standard and widely accepted JSON content type to use is:

application/json

You should use it because:

  • the content type for transmitting JSON data in HTTP requests and responses.
  • It is the official MIME type for JSON data and is supported by all modern browsers and web servers.

Other are obselete:

The other content types user mentioned (application/x-javascript, text/javascript, text/x-javascript, text/x-json) were used in the past when JSON was not as standardized as it is now. However, using them today is not recommended due to potential security and compatibility issues.

Security Concerns:

  • Some older browsers may interpret JavaScript content types (application/x-javascript, text/javascript, text/x-javascript) as executable scripts, potentially leading to security vulnerabilities if an attacker injects malicious code.

  • Serving JSON data with non-standard content types might trigger security mechanisms in certain browsers or web applications.

Browser Support:

  • While modern browsers have largely standardized on application/json, some older browsers might not handle other content types correctly.
  • application/json is supported by all major browsers and has become the de facto standard for JSON data.

Hope it helps.

1
2

Not the answer you're looking for? Browse other questions tagged or ask your own question.