MIME Type — what it is, file types and detection in iOS

What is MIME Type?

MIME Type (Multipurpose Internet Mail Extensions) is a standardized data format identifier consisting of two parts: a main type (type) and a subtype (subtype), separated by a forward slash. Main categories: text, image, audio, video, application (binary data), multipart (composite messages).

The MIME standard was originally developed for email attachments (RFC 2046, 1996), but today it is used everywhere: HTTP servers specify the Content-Type of responses, browsers determine how to handle files, and mobile applications identify which data can be opened. IANA (Internet Assigned Numbers Authority) maintains a registry of registered MIME types.

According to IANA Media Types Registry (2024), over 1,800 official MIME types are registered, and the actual number including custom and vendor types exceeds 5,000. iOS supports most standard types and provides APIs for working with them through Uniform Type Identifiers.

MIME and UTI in iOS: Differences and Conversion

UTI (Uniform Type Identifier) is Apple’s own content type identification system used within iOS and macOS. Unlike MIME, UTI supports an inheritance hierarchy (e.g., public.image is the parent of public.png and public.jpeg) and includes not only file formats but also abstract data types.

Conversion between MIME and UTI in iOS is performed through the UTType class (iOS 14+). The system maintains an internal mapping database that covers most standard formats. For custom types, the developer registers the mapping in Info.plist.

import UniformTypeIdentifiers

let mimeType = "image/jpeg"
if let uti = UTType(mimeType: mimeType) {
    print("UTI: \(uti.identifier)")
    print("Conforms to image: \(uti.conforms(to: .image))")
    print("Extension: \(uti.preferredFilenameExtension ?? "")")
}

// Reverse conversion: UTI to MIME
if let uti = UTType(filenameExtension: "pdf"),
   let mime = uti.preferredMIMEType {
    print("MIME for PDF: \(mime)")
}

UTI hierarchy allows checking whether a type conforms to a certain category. For example, all image types (JPEG, PNG, GIF) conform(to: .image). This is convenient for group filtering and determining if a type can be handled by system components.

Important difference: MIME is a flat classification (no inheritance), while UTI supports multiple inheritance. For example, public.html conforms to both public.source-code and public.text. This provides more flexible routing when processing files in iOS.

How to Determine MIME Type of a File in iOS

Three methods for determining MIME Type are available in iOS: by file extension (fast but unreliable), by content via magic bytes (reliable but requires reading the file), and by HTTP Content-Type header (only for network requests).

import UniformTypeIdentifiers

enum MIMEDetector {
    // Detect by extension
    static func fromExtension(_ ext: String) -> String? {
        UTType(filenameExtension: ext)?.preferredMIMEType
    }

    // Detect by content (magic bytes)
    static func fromFile(at url: URL) -> String? {
        guard let handle = try? FileHandle(forReadingFrom: url) else {
            return nil
        }
        defer { handle.closeFile() }
        let header = handle.readData(ofLength: 12)

        // PNG: 89 50 4E 47 0D 0A 1A 0A
        // JPEG: FF D8 FF
        // PDF: 25 50 44 46
        // ZIP: 50 4B 03 04

        if header.starts(with: [0x89, 0x50, 0x4E, 0x47]) {
            return "image/png"
        }
        if header.starts(with: [0xFF, 0xD8, 0xFF]) {
            return "image/jpeg"
        }
        if header.starts(with: [0x25, 0x50, 0x44, 0x46]) {
            return "application/pdf"
        }
        return nil
    }
}

Extension-based detection through UTType is the fastest method, but it is unreliable if the extension is missing or faked. An attacker could rename .exe to .jpg — the system would identify it as image/jpeg even though the file is executable. For critical scenarios (security, medical data), always use content-based verification.

Magic bytes are the first bytes of a file, unique to each format. Most formats have a signature of 2–12 bytes. iOS does not provide a built-in MIME detector by content — the developer either implements a signature table themselves or uses libraries like CocoaLumberjack or a custom heuristic-based detector.

Registering Custom MIME and UTI Types

Custom types are necessary when an application works with proprietary data formats not registered with IANA or Apple. Registration in Info.plist allows iOS to correctly handle such files: open them from Files.app, display icons, and pass them to other applications via UIActivityViewController.

<key>CFBundleDocumentTypes</key>
<array>
    <dict>
        <key>CFBundleTypeName</key>
        <string>MyApp Document</string>
        <key>LSHandlerRank</key>
        <string>Owner</string>
        <key>LSItemContentTypes</key>
        <array>
            <string>com.myapp.secret-doc</string>
        </array>
    </dict>
</array>
<key>UTExportedTypeDeclarations</key>
<array>
    <dict>
        <key>UTTypeIdentifier</key>
        <string>com.myapp.secret-doc</string>
        <key>UTTypeTagSpecification</key>
        <dict>
            <key>public.filename-extension</key>
            <array><string>sdoc</string></array>
            <key>public.mime-type</key>
            <array><string>application/vnd.myapp.secret-doc</string></array>
        </dict>
    </dict>
</array>

To register a custom type, you need to specify in Info.plist: the UTI identifier (in reverse-DNS format), conformance to parent types, file extension, and MIME type. iOS uses this information for file routing: when a user opens a .sdoc file, the system knows its owner is your application.

UTExportedTypeDeclarations — for types defined by your application (export). UTImportedTypeDeclarations — for types created by other applications that your app can work with (import). Apple recommends registering all custom types your application works with for correct system integration.

Security and Handling Unknown Types

Unknown MIME types pose a security risk for iOS applications. If a file has an unknown or unverified type, the application should take precautions: do not open the file automatically, show a warning to the user, or analyze the content before processing.

Main threats: a file with a faked MIME type may contain malicious code or an exploit targeting a parser vulnerability. iOS protects the system through Sandbox, but the application may be vulnerable if it trusts the MIME type without verifying the content. Always check files by magic bytes if they come from an untrusted source.

According to OWASP Mobile Security Guide, 2024, the following practices apply for handling files of unknown types: reject files with MIME type application/octet-stream from untrusted sources; use UTType to check conformance to expected categories; do not open files in external applications without user confirmation; log all cases of MIME and actual content mismatch for security auditing.

Custom MIME type registration in Info.plist is not only about functionality but also security. If an application correctly registers only its own types, the system will not mistakenly pass other files to it. Use specific vendor prefixes (application/vnd.company.app-format) instead of generic ones (application/x-format) to avoid conflicts with other applications.