Network Working Group M. Nottingham
Internet-Draft Cloudflare
Obsoletes: [6838, 9694] (if approved) P. Resnick
Intended status: Best Current Practice 18 June 2025
Expires: 20 December 2025
Media Type Specifications and Registration Procedures
draft-ietf-mediaman-6838bis-05
Abstract
This document defines procedures for the specification and
registration of media types for use in HTTP, MIME, and other Internet
protocols.
About This Document
This note is to be removed before publishing as an RFC.
Status information for this document may be found at
https://datatracker.ietf.org/doc/draft-ietf-mediaman-6838bis/.
information can be found at https://datatracker.ietf.org/wg/mediaman/
about/.
Source for this draft and an issue tracker can be found at
https://github.com/ietf-wg-mediaman/6838bis/.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 20 December 2025.
Nottingham & Resnick Expires 20 December 2025 [Page 1]
Internet-Draft Media Type Registration June 2025
Copyright Notice
Copyright (c) 2025 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Conventions Used in This Document . . . . . . . . . . . . 4
2. Media Type Registration Requirements . . . . . . . . . . . . 4
2.1. Functionality . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Publication . . . . . . . . . . . . . . . . . . . . . . . 4
2.2.1. Specification Availability . . . . . . . . . . . . . 5
2.2.2. Intellectual Property . . . . . . . . . . . . . . . . 5
2.3. Canonicalization and Interoperability . . . . . . . . . . 5
2.4. Naming . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4.1. Aliases . . . . . . . . . . . . . . . . . . . . . . . 7
2.5. Parameters . . . . . . . . . . . . . . . . . . . . . . . 7
2.6. Encoding . . . . . . . . . . . . . . . . . . . . . . . . 8
2.7. Fragment Identifiers . . . . . . . . . . . . . . . . . . 9
2.8. Security . . . . . . . . . . . . . . . . . . . . . . . . 9
2.9. Additional Information . . . . . . . . . . . . . . . . . 10
2.10. Non-Requirements . . . . . . . . . . . . . . . . . . . . 11
3. Top-Level Media Types . . . . . . . . . . . . . . . . . . . . 12
3.1. Additional Top-Level Types . . . . . . . . . . . . . . . 12
3.1.1. Required Criteria . . . . . . . . . . . . . . . . . . 12
3.1.2. Additional Considerations . . . . . . . . . . . . . . 13
3.1.3. Negative Criteria . . . . . . . . . . . . . . . . . . 14
4. Media Subtypes . . . . . . . . . . . . . . . . . . . . . . . 14
4.1. Registration Trees . . . . . . . . . . . . . . . . . . . 14
4.1.1. Standards Tree . . . . . . . . . . . . . . . . . . . 15
4.1.2. Vendor Tree . . . . . . . . . . . . . . . . . . . . . 16
4.1.3. Personal Tree . . . . . . . . . . . . . . . . . . . . 17
4.1.4. Unregistered x. Tree . . . . . . . . . . . . . . . . 18
4.1.5. Additional Registration Trees . . . . . . . . . . . . 18
4.2. Structured Syntax Suffixes . . . . . . . . . . . . . . . 18
4.2.1. Use Cases for Structured Syntax Suffixes . . . . . . 19
4.2.2. Fragment Identifiers and Structured Syntax
Suffixes . . . . . . . . . . . . . . . . . . . . . . 20
Nottingham & Resnick Expires 20 December 2025 [Page 2]
Internet-Draft Media Type Registration June 2025
4.2.3. Security Considerations for Structured Syntax Suffix
Processing . . . . . . . . . . . . . . . . . . . . . 20
4.2.4. Additional Structured Syntax Suffixes . . . . . . . . 21
5. Media Type Registration Procedures . . . . . . . . . . . . . 21
5.1. Preliminary Community Review . . . . . . . . . . . . . . 21
5.2. Submit Request to IANA . . . . . . . . . . . . . . . . . 22
5.2.1. Provisional Registrations . . . . . . . . . . . . . . 22
5.3. Review and Approval . . . . . . . . . . . . . . . . . . . 22
5.4. Comments on Media Type Registrations . . . . . . . . . . 23
5.5. Change Procedures . . . . . . . . . . . . . . . . . . . . 23
5.6. Registration Template . . . . . . . . . . . . . . . . . . 24
6. Structured Syntax Suffix Registration Procedures . . . . . . 25
6.1. Change Procedures . . . . . . . . . . . . . . . . . . . . 26
6.2. Structured Syntax Suffix Registration Template . . . . . 26
7. Security Considerations . . . . . . . . . . . . . . . . . . . 27
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27
8.1. Top-Level Types Registry . . . . . . . . . . . . . . . . 27
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 28
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 28
10.1. Normative References . . . . . . . . . . . . . . . . . . 28
10.2. Informative References . . . . . . . . . . . . . . . . . 29
Appendix A. Historical Note . . . . . . . . . . . . . . . . . . 30
Appendix B. Grandfathered Media Types . . . . . . . . . . . . . 31
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 31
1. Introduction
Internet application protocols (including but not limited to HTTP
[RFC9110] and MIME [RFC2045]) are capable of carrying arbitrary
labeled content.
Those labels are known as media types. A media type consists of a
top-level type (Section 3) and a subtype (Section 4), which is
further structured into a tree (identified by a prefix). A subtype
can also be associated with a structured syntax (identified by
suffix). Optionally, a media type can be defined to allow companion
data, known as parameters.
Section 2 defines the criteria for registering media types.
Section 5 outlines the procedures used to do so. The location of the
media type registry is:
http://www.iana.org/assignments/media-types/
Section 6 outlines the procedures for managing the registry for
structured syntax suffixes. It is located at:
https://www.iana.org/assignments/media-type-structured-suffix/
Nottingham & Resnick Expires 20 December 2025 [Page 3]
Internet-Draft Media Type Registration June 2025
1.1. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119] when they
appear in ALL CAPS. They may also appear in lower or mixed case as
plain English words, without any normative meaning.
This specification makes use of the Augmented Backus-Naur Form (ABNF)
[RFC5234] notation, including the core rules defined in Appendix B of
that document.
2. Media Type Registration Requirements
Media type registrations are expected to conform to various
requirements laid out in the following sections. Note that specific
requirements can vary depending on the registration tree
(Section 4.1).
Additional requirements specific to the registration of XML media
types are specified in [RFC7303].
2.1. Functionality
Media types MUST function as actual media formats. Registration of
things that are better thought of as a transfer encoding, as a
charset, or as a collection of separate entities of another type, is
not allowed. For example, although applications exist to decode the
base64 transfer encoding [RFC2045], base64 cannot be registered as a
media type.
This requirement applies regardless of the registration tree
involved.
2.2. Publication
Media types registered in the standards tree by the IETF MUST be
published as RFCs. Media types registered in the vendor and personal
trees can be published as RFCs, but this is not required.
Standards-tree registrations for media types defined by other
standards-related organizations MUST be described by a formal
specification produced by that organization.
Other than IETF registrations in the standards tree, the registration
of a media type does not imply endorsement, approval, or
recommendation by the IANA or the IETF or even certification that the
specification is adequate.
Nottingham & Resnick Expires 20 December 2025 [Page 4]
Internet-Draft Media Type Registration June 2025
Registration of a new top-level type requires Standards Action in the
IETF and, hence, the publication of a RFC on the Standards Track.
2.2.1. Specification Availability
A permanent and readily available public specification of the format
for the media type MUST exist for all types registered in the
standards tree. This specification needs provide sufficient detail
so that interoperability between independent implementations using
the media type is possible. If not part of the media type
registration proposal, this specification needs to be referenced by
it.
A specification need not be publicly available for media types
registered in the vendor and personal trees. Note, however, that the
public availability of a specification will often make the difference
between having a name reserved and having the potential for useful
interoperation.
2.2.2. Intellectual Property
The registration of media types involving patented technology is
permitted. However, the restrictions set forth in BCP 79 [RFC8179]
and BCP 78 [RFC5378] on the use of patented technology in IETF
Standards Track protocols must be respected when the specification of
a media type is part of a Standards Track protocol. In addition,
other standards-related organizations making use of the standards
tree may have their own rules regarding intellectual property that
must be observed in their registrations.
Intellectual Property Rights (IPR) disclosures for registrations in
the vendor and personal trees are encouraged but not required.
Copyright on the registration template needs to allow the IANA to
copy it into the IANA registry.
2.3. Canonicalization and Interoperability
All registered media types MUST employ a single, canonical data
format, regardless of registration tree.
Ideally, media types will be defined so they interoperate across as
many systems and applications as possible. However, some media types
will inevitably have problems interoperating across different
platforms. For example, problems with different versions, byte
ordering, and specifics of gateway handling can arise.
Nottingham & Resnick Expires 20 December 2025 [Page 5]
Internet-Draft Media Type Registration June 2025
Universal interoperability of media types is not required, but known
interoperability issues should be identified whenever possible.
Publication of a media type does not require an exhaustive review of
interoperability, and the interoperability considerations section is
subject to continuing evaluation.
The recommendations in this subsection apply regardless of the
registration tree involved.
2.4. Naming
All registered media types MUST be assigned top-level type and
subtype names. The combination of these names serves to uniquely
identify the media type, and the subtype name facet (or the absence
of one) identifies the registration tree. Both top-level type and
subtype names are case-insensitive.
Type and subtype names MUST conform to the following ABNF:
type-name = restricted-name
subtype-name = restricted-name
restricted-name = restricted-name-first *126restricted-name-chars
restricted-name-first = ALPHA / DIGIT
restricted-name-chars = ALPHA / DIGIT / "!" / "#" /
"$" / "&" / "-" / "^" / "_"
restricted-name-chars =/ "." ; Characters before first dot always
; specify a facet name
restricted-name-chars =/ "+" ; Characters after last plus always
; specify a structured syntax suffix
Note that this syntax is somewhat more restrictive than what is
allowed by Section 5.1 of [RFC2045] or Section 4.2 of [RFC4288].
Also note that while this syntax allows type and subtype names of up
to 127 characters, implementation limits may make such long names
problematic. For this reason, 'type-name' and 'subtype-name' SHOULD
be limited to 64 characters.
Although this syntax treats "." as equivalent to any other character,
characters before any initial "." always specify the registration
facet. Note that this means that facet-less standards tree
registrations cannot use periods in the subtype name.
Similarly, the final "+" in a subtype name introduces a structured
syntax specifier suffix. Structured syntax suffix requirements are
specified in Section 4.2.
Nottingham & Resnick Expires 20 December 2025 [Page 6]
Internet-Draft Media Type Registration June 2025
While it is possible for a given media type to be assigned more than
one name, the use of different names to identify the same media type
is discouraged.
These requirements apply regardless of the registration tree
involved.
2.4.1. Aliases
In some cases, a single media type may have been widely deployed
using multiple names prior to registration. In such cases, a
preferred name MUST be chosen for the media type, and applications
are required use this to be compliant with the type's registration.
However, a list of deprecated aliases by which the type is known can
be supplied as additional information in order to assist applications
in processing the media type properly.
2.5. Parameters
Media types can be defined to allow or require use of media type
parameters. Additionally, some parameters may be automatically made
available to the media type by virtue of being a subtype of a content
type that defines a set of parameters applicable to any of its
subtypes.
In either case, the names, values, and meanings of any parameters are
required to be fully specified when a media type is registered in the
standards tree, and should be specified as completely as possible
when media types are registered in the vendor or personal trees.
Parameter names have the same syntax as media type names and values:
parameter-name = restricted-name
Note that this syntax is somewhat more restrictive than what is
allowed by the ABNF in [RFC2045] and amended by [RFC2231].
Parameter names are case-insensitive and no meaning is attached to
the order in which they appear. It is an error for a specific
parameter to be specified more than once.
There is no defined syntax for parameter values; therefore, it needs
to be specified upon registration. Additionally, some transports
impose restrictions on parameter value syntax, so care needs be taken
to limit the use of potentially problematic syntaxes; for example,
binary valued parameters, while permitted in some protocols, are best
avoided.
Nottingham & Resnick Expires 20 December 2025 [Page 7]
Internet-Draft Media Type Registration June 2025
Note that a protocol can impose further restrictions on parameter
value syntax, depending on how it chooses to represent parameters.
Both MIME [RFC2045] [RFC2231] and HTTP [RFC9110] [RFC8187] allow
binary parameters as well as parameter values expressed in a specific
charset, but other protocols may be less flexible.
Types already registered in the standards tree should not have new
functionality added through the definition of new parameters
subsequent to the original registration. New parameters can be used
to convey additional information that does not otherwise change
existing functionality. An example of this would be a "revision"
parameter to indicate a revision level of an external specification
such as JPEG. Similar behavior is encouraged for media types
registered in the vendor or personal trees, but is not required.
Changes to parameters (including the introduction of new ones) is
managed in the same manner as other changes to the media type; see
Section 5.5.
2.6. Encoding
Some transports impose restrictions on the type of data they can
carry. For example, Internet mail traditionally was limited to 7bit
US-ASCII text. Encoding schemes are often used to work around such
transport limitations.
An "encoding considerations" field is provided to note what sort of
data a media type can consist of as part of its registration.
Possible values of this field are:
7bit: The content of the media type consists solely of CRLF-
delimited 7bit US-ASCII text.
8bit: The content of the media type consists solely of CRLF-
delimited 8bit text.
binary: The content consists of an unrestricted sequence of octets.
framed: The content consists of a series of frames or packets
Nottingham & Resnick Expires 20 December 2025 [Page 8]
Internet-Draft Media Type Registration June 2025
without internal framing or alignment indicators. Additional out-
of-band information is needed to interpret the data properly,
including but not limited to knowledge of the boundaries between
successive frames and knowledge of the transport mechanism. Note
that media types of this sort cannot be stored in a file or
transported as a stream of octets without further context;
therefore, such media types are thus unsuitable for use in many
traditional protocols. A commonly used transport with framed
encoding is the Real-time Transport Protocol, RTP. Additional
rules for framed encodings defined for transport using RTP are
given in [RFC4855].
Additional restrictions on 7bit and 8bit text are given in
Section 4.1.1 of [RFC2046].
2.7. Fragment Identifiers
Media type registrations can specify how applications should
interpret fragment identifiers (specified in Section 3.5 of
[RFC3986]) associated with the media type.
Media types are encouraged to adopt fragment identifier schemes that
are used with semantically similar media types. In particular, media
types that use a structured syntax with a registered "+suffix" MUST
follow whatever fragment identifier rules are given in the structured
syntax suffix registration.
2.8. Security
All registrations of types in the standards tree MUST include an
analysis of security issues. A similar analysis for media types
registered in the vendor or personal trees is encouraged but not
required.
All descriptions of security issues need to be as accurate as
possible regardless of registration tree. In particular, the
security considerations MUST NOT state that there are "no security
issues associated with this type". Security considerations for types
in the vendor or personal tree can say that "the security issues
associated with this type have not been assessed".
There is no requirement that media types registered in any tree be
secure or completely free from risks. Nevertheless, all known
security risks need to be identified in the registration of a media
type, again regardless of registration tree.
Nottingham & Resnick Expires 20 December 2025 [Page 9]
Internet-Draft Media Type Registration June 2025
The security considerations section of all registrations is subject
to continuing evaluation and modification, and in particular can be
extended by use of the "comments on media types" mechanism described
in Section 5.4 below.
Issues that need to be described in a security analysis of a media
type include:
* Processing of complex media types might institute actions on a
recipient's files or other resources. If it is possible to
specify arbitrary actions in an unrestricted fashion, it could
have devastating effects. See the registration of the
application/postscript media type in [RFC2046] for an example of
description and handling of these issues.
* Any security analysis MUST state whether or not the format employs
such "active content"; if it does, it MUST state what steps have
been taken (or are required be taken by applications) of the media
type to protect users of the media type.
* Processing of complex media types might institute actions that,
while not directly harmful to the recipient, may result in
disclosure of information that either facilitates a subsequent
attack or else violates a recipient's privacy in some way. Again,
the registration of the application/ postscript media type
illustrates how such directives can be handled.
* A media type that employs compression may provide an opportunity
for sending a small amount of data that, when received and
evaluated, expands enormously to consume all of the recipient's
resources. All media types should state whether or not they
employ compression; if they do, they should discuss what steps
need to be taken to avoid such attacks.
* A media type might be targeted for applications that require some
sort of security assurance but don't provide the necessary
security mechanisms themselves. For example, a media type could
be defined for storage of sensitive medical information that in
turn requires external confidentiality and integrity protection
services, or which is designed for use only within a secure
environment. Types should always document whether or not they
need such services in their security considerations.
2.9. Additional Information
The following optional information should be included in the
specification of a media type if it is available:
Nottingham & Resnick Expires 20 December 2025 [Page 10]
Internet-Draft Media Type Registration June 2025
* Magic number(s) (length, octet values). Magic numbers are byte
sequences that are always present at a given place in the file and
thus can be used to identify entities as being of a given media
type.
* File name extension(s) commonly used on one or more platforms to
indicate that some file contains a given media type.
* macOS Uniform Type Identifier (a string), if it makes sense to
exchange media of this type through user-triggered exchange
mechanisms such as copy-and-paste or drag-and-drop on macOS and
related platforms (see [MacOSUTIs] for definitions and syntax).
* Windows clipboard name (a string), if it makes sense to exchange
media of this type through user-triggered exchange mechanisms such
as copy-and-paste or drag-and-drop on Microsoft Windows and
related platforms (see [windowsClipboardNames] for definitions and
syntax).
In the case of a registration in the standards tree, this additional
information can be provided in the formal specification of the media
type format. It is suggested that this be done by incorporating the
IANA media type registration form into the specification itself.
2.10. Non-Requirements
Universal support and implementation of a media type are NOT a
requirement for registration.
In some environments such as mail, information on the capabilities of
the remote mail agent is frequently not available to the sender.
When this is the case, maximum interoperability might be attained by
restricting the media types used to those "common" formats expected
to be widely implemented.
In the past, this reasoning was used to limit the number of possible
media types, and resulted in a registration process with a
significant hurdle and delay for those registering media types.
However, the need for "common" media types does not require limiting
the registration of new media types. If a limited set of media types
is recommended for a particular application, that should be asserted
by a separate applicability statement specific for that environment.
A media type intended for limited use should note this in its
registration. The "Restrictions on Usage" field is provided for this
purpose.
Nottingham & Resnick Expires 20 December 2025 [Page 11]
Internet-Draft Media Type Registration June 2025
3. Top-Level Media Types
The list of top-level types is maintained in the IANA Top-Level Media
Types registry at:
https://www.iana.org/assignments/top-level-media-types/
Top-level types can place various restrictions on the media types
that use them. New media types MUST conform to the restrictions (if
any) of their top-level type.
3.1. Additional Top-Level Types
In some cases, a new media type may not be easily classified under
any currently defined top-level type names. Such cases are expected
to be quite rare. However, if such a case does arise, a new top-
level type can be defined to accommodate it.
3.1.1. Required Criteria
Definitions of new top-level types are required to fulfil the
following criteria:
* The top-level type is defined in a Standards Track RFC (see
Section 4.9 of [RFC8126]). This will make sure there is
sufficient community interest, review, and consensus.
* The IANA Considerations section of that RFC requests that IANA add
this new top-level type to the registry of top-level types.
* The criteria for what types do and do not fall under the new top-
level type are defined clearly. This will help expert reviewers
to evaluate whether a subtype belongs below the new type or not,
and whether the registration template for a subtype contains the
appropriate information. If the criteria cannot be defined
clearly, this is a strong indication that whatever is being talked
about is not suitable as a top-level type.
* The RFC clearly documents security considerations applying to all
or a significant subset of subtypes.
* At the minimum, one subtype is described. A top-level type
without any subtype serves no purpose. Please note that the
'example' top-level describes a subtype 'example'.
Nottingham & Resnick Expires 20 December 2025 [Page 12]
Internet-Draft Media Type Registration June 2025
3.1.2. Additional Considerations
Additional considerations for the definition of a new top-level type
include:
* Existing wide use of an unregistered top-level type may be an
indication of a need, and therefore an argument for formally
defining a new top-level type. On the other hand, the use of
unregistered top-level types is highly discouraged.
* Use of an IETF Working Group to define a new top-level type is not
needed, but may be advisable in some cases. There are examples of
new top-level type definitions without a Working Group
([RFC2077]), with a short, dedicated WG ([RFC8081]), and with a
Working Group that included other related work
([I-D.ietf-mediaman-haptics]).
* The document defining the new top-level type should include
initial registrations of actual subtypes. The exception may be a
top-level type similar to 'example'. This will help to show the
need for the new top-level type, will allow checking the
appropriateness of the definition of the new top-level type, will
avoid separate work for registering an initial slate of subtypes,
and will provide examples of what is considered a valid subtype
for future subtype registrations.
* The registration and actual use of a certain number of subtypes
under the new top-level type should be expected. The existence of
a single subtype should not be enough; it should be clear that new
similar types may appear in the future. Otherwise, the creation
of a new top-level type is likely unjustified.
* The proposers of the new top-level type and the wider community
should be willing to commit to emitting and consuming the new top-
level type in environments that they control.
* The fact that a group of (potential) types have (mostly) common
parameters may be an indication that these belong under a common
new top-level type.
* Top-level types can help humans with understanding and debugging.
Therefore, evaluating how a new top-level type helps humans
understand types may be crucial.
* Common restrictions may apply to all subtypes of a top-level type.
Examples are the restriction to CRLF line endings for subtypes of
type 'text' (at least in the context of electronic mail), or on
subtypes of type 'multipart'.
Nottingham & Resnick Expires 20 December 2025 [Page 13]
Internet-Draft Media Type Registration June 2025
* Top-level types are also used frequently in dispatching code. For
example "multipart/*" is frequently handled as multipart/mixed,
without understanding of a specific subtype. The top-level types
'image', 'audio', and 'video' are also often handled generically.
Documents with these top-level types can be passed to applications
handling a wide variety of image, audio, or video formats. HTML
generating applications can select different HTML elements (e.g.
or