The "font" Top-Level Media Type
Extracted elements (20)
The 'application' subtree was deemed inappropriate for fonts for three reasons: it is treated with caution with respect to viruses and active code; it precludes a common set of optional parameters across font types; and fonts have unique licensing and usage restrictions that warrant their own top-level category.
The 'font' top-level type was created because existing font subtypes registered under 'application' were severely under-utilized while developers were spontaneously using intuitive but unregistered types like 'font/woff' and 'font/ttf'. Data showed web font adoption grew from 1% in 2010 to 50% by 2015, while officially defined 'application/font-*' types saw very limited use.
A single SFNT-based font file can contain glyph encodings in multiple outline formats (e.g., both TrueType and PostScript/CFF outlines simultaneously). Rendering engines may not support all formats, so the optional 'outlines' parameter allows clients to determine format compatibility before downloading.
WOFF 2.0 is an improvement on WOFF 1.0 but the two formats have different Internet Media Types and different @font-face format identifiers ('woff' vs 'woff2'), and they may be used in parallel. WOFF 2.0 fragment identifiers follow Section 4.2.
If a fragment identifier (following un-escaping) does not match any PostScript name in the name table, or if no fragment is specified, the first font in the collection is matched. The document notes that relying on a particular font always being first is unwise as ordering may change across revisions.
New font formats SHOULD be registered using the IANA online media type registration form, consulting RFC 6838 on registration procedures. The font specification SHOULD preferably be freely available, and if the format can contain multiple fonts, a fragment identifier syntax SHOULD also be defined.
Unrecognized subtypes of 'font' SHOULD be treated as 'application/octet-stream'. Implementations MAY pass unrecognized subtypes to a common font-handling system if such a system is available.
Fragment identifiers for font collections identify a specific font within the collection by its PostScript name (name ID=6), which is a string no longer than 63 characters restricted to printable ASCII codes 33–126, excluding 10 forbidden characters and requiring percent-encoding of 6 URI-reserved characters.
The font/collection subtype covers font collection files containing multiple fonts, with an optional 'outlines' parameter (TTF, CFF, SVG). File extension is .ttc; the @font-face format identifier is 'collection'. Fragment identifiers (Section 4.2) MUST be used to select individual fonts within the collection.
The font/otf subtype covers OpenType Layout fonts with an optional 'outlines' parameter (TTF, CFF, SVG). The @font-face format identifier is 'opentype'. The Macintosh UTI is 'public.opentype-font'. SVG outlines have no independent magic number and always accompany TrueType or CFF outlines.
The font/sfnt subtype is a generic SFNT font type with optional parameters: 'outlines' (comma-separated subset of TTF, CFF, SVG) indicating glyph outline format, and 'layout' (comma-separated subset of OTL, AAT, SIL) indicating advanced text layout support. The existing 'application/font-sfnt' registration is deprecated in its favor.
The font/ttf subtype covers TrueType fonts with an optional 'layout' parameter (OTL, AAT, SIL). The @font-face format identifier is 'truetype'. File extensions are .ttf and .otf; the Macintosh UTI is 'public.truetype-font'.
The font/woff subtype covers WOFF 1.0 fonts, used by web browsers with HTML and CSS. The existing 'application/font-woff' registration is deprecated in favor of 'font/woff'. No optional parameters are defined.
This document registers 'font' as a new top-level media type in the IANA standards tree, under which subtypes for font representation formats may be registered. It also registers six initial subtypes: font/sfnt, font/ttf, font/otf, font/collection, font/woff, and font/woff2.
Font data formats provide neither privacy nor confidentiality protection internally. While some formats include checksums and digital signatures for data integrity, any privacy or confidentiality protection must be provided externally (e.g., via transport-layer security).
Font data structures are extremely flexible and extensible (especially SFNT-based formats), making it easy to hide arbitrary binary data inside a font file. There is significant risk that this flexibility may be exploited to conceal malicious binary content disguised as font data components.
TrueType hint instructions represent executable code interpreted by the font rasterizer for glyph alignment. A maliciously designed font could cause undue resource consumption (memory or CPU cycles). Most font interpreters cannot be completely protected from malicious fonts without undue performance penalties.
The WOFF 1.0 signature field MUST contain the 4-byte magic number 0x774F4646 (ASCII 'wOFF'). The file extension is .woff and the Macintosh UTI is 'org.w3.woff'.
The WOFF 2.0 signature field MUST contain the 4-byte magic number 0x774F4632 (ASCII 'wOF2'). The file extension is .woff2 and the Macintosh UTI is 'org.w3.woff2'.
TrueType fonts and OFF/OpenType fonts containing TrueType outlines use 0x00010000 as the 'sfnt' version number (4-byte magic number). OFF/OpenType fonts containing CFF data use the 4-byte ASCII tag 'OTTO' (0x4F54544F) as the 'sfnt' version number.