About Excel 97–2003 workbook files
The binary Excel format, stored in an OLE2 compound file. Watch out in upload handlers: on Windows machines with Excel installed, browsers often report .csv files as application/vnd.ms-excel too, because the type comes from the Windows registry.
File signature
XLS files start with D0 CF 11 E0 A1 B1 1A E1 (OLE2 compound file). The extension and the type a browser reports for an upload both
come from the file name, so check these bytes on the server before trusting a file.
Serve .xls with the right Content-Type
Content-Type: application/vnd.ms-excel
application/vnd.ms-excel xls xlt;
AddType application/vnd.ms-excel .xls .xlt
@xls path *.xls *.xlt
header @xls Content-Type "application/vnd.ms-excel"
curl -sI https://example.com/file.xls | grep -i '^content-type'
# Content-Type: application/vnd.ms-excel
Set the type in code
res.set('Content-Type', 'application/vnd.ms-excel');
// Or make the browser download it:
res.attachment('file.xls');
import mimetypes
mimetypes.add_type('application/vnd.ms-excel', '.xls') # if your system doesn't know it
mimetypes.guess_type('file.xls')[0] # 'application/vnd.ms-excel'
mime.AddExtensionType(".xls", "application/vnd.ms-excel")
w.Header().Set("Content-Type", "application/vnd.ms-excel")
Accept .xls uploads
<input type="file" accept=".xls,.xlt,application/vnd.ms-excel">
The accept attribute only filters the file picker; users can still choose another file. Listing the
extension as well as the type matters, because operating systems don’t always report the type you expect.
Related types
-
.xlsx (
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet): Excel workbook -
.csv (
text/csv): CSV -
.doc (
application/msword): Word 97–2003 document
More documents
.pdf , .docx , .ppt , .pptx , .odt , .rtf , .epub . Look up any extension or type with the MIME type lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is the MIME type for .xls files?
application/vnd.ms-excel. The full header is "Content-Type: application/vnd.ms-excel".
Why does my server send the wrong Content-Type for .xls?
Web servers pick the type from the file extension using a table (mime.types in nginx and Apache). If .xls is missing from that table, they send a default such as application/octet-stream or text/plain. Add the mapping as shown on this page, then check the response with "curl -sI".
How can I check that a file really is XLS?
Look at the first bytes rather than the extension or the type the browser reports, which both come from the file name. XLS files start with D0 CF 11 E0 A1 B1 1A E1 (OLE2 compound file). The MIME type lookup on this site reads them for you when you drop a file on it.