Media type / text
text/css
Cascading style sheets. Browsers refuse to apply a stylesheet served under any other type when the page is in standards mode.
Served inline: Browsers display this in the tab without granting it script access to the page. Safe to serve inline, provided the bytes really are what the header claims.
Browser behaviour
Renders inertly
Charset
charset required
Compression
Compress in transit
Send it like this
Content-Type: text/css; charset=utf-8Send `; charset=utf-8`. Without it the receiver falls back to its own default — for some text types that default is us-ascii, and any non-ASCII character then renders wrong.
Handling verdict
Browsers display this in the tab without granting it script access to the page. Safe to serve inline, provided the bytes really are what the header claims.
Send `; charset=utf-8`. Without it the receiver falls back to its own default — for some text types that default is us-ascii, and any non-ASCII character then renders wrong.
The payload is text-like or otherwise repetitive, so gzip or Brotli removes real bytes. Enable it at the server or CDN.
Registered with IANA through a public review process, so the name is stable and every implementation can rely on it meaning the same thing.
Anatomy of the name
RFC 6838Top-level type
text
Text
Subtype
css
Registered in the standards tree.
Structured syntax
none
No suffix, so the payload format is defined entirely by the subtype itself.
Parameters
charset
Beyond the charset rule above, this type defines no parameters of its own.
What trips people up
2 notes- A stylesheet served as text/plain is ignored in standards mode — this is the usual cause of an unstyled page in production but not locally.
- CSS is not inert: selectors and url() can be used to exfiltrate page state, so an attacker-controlled stylesheet is still a real risk.
Response headers
Content-Type: text/css; charset=utf-8
X-Content-Type-Options: nosniff
Content-Disposition: inline
Vary: Accept-Encodingnosniff stops the browser second-guessing the type you declared, which is what makes the rest of this reliable. Serving it inline is safe here because the browser renders it without granting it script access.
Server configuration
extension mappingnginx
types {
text/css css;
}Apache
AddType text/css .css
AddCharset UTF-8 .cssCaddy
@type path *.css
header @type Content-Type "text/css; charset=utf-8"Extensions and other spellings
declaredFile extensions
File signature
No fixed signature — this format has no reliable magic number, so identify it by parsing rather than by the first few bytes.