Look up common media types, parse Content-Type safely, inspect local file signatures, detect extension/type mismatches, and test Accept negotiation without uploading files.
Extensions are conventions. Servers should send an accurate Content-Type, and security-sensitive workflows should inspect content rather than trust names alone.
Types ending in +json, +xml, +cbor and similar suffixes communicate a base representation while preserving application-specific semantics.
For untrusted web content, accurate types plus X-Content-Type-Options: nosniff help prevent browsers from interpreting content as a different active format.