> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Content Signatures

<Warning>
  **This section does not appear in the Configure console.** Verified 2026-09-04 against `http://safesquid.cfg`, build `2026.0627.1344.3`: the section is absent from the console's own section registry, not merely hidden from the menu. It is kept here as legacy and reference material, not a current UI path. Confirm against your own build before pointing an administrator at it.
</Warning>

The **Content Signatures** section maintains the content-signature database and libmagic MIME detection used across SafeSquid. It helps identify actual file types, bypassing deceptive file extensions — but live connection tagging for policy uses [Response Types](/configuration/custom_settings/response_types) in the current build.

<Note>
  Custom rows are merged into `content4.xml` under `/var/lib/safesquid/content_signatures/`. Tag names still appear in DLP and UI pickers even when the request-time hooks are inactive.
</Note>

## Core mechanics

### What runs at runtime today

1. On config load and on scheduled update, SafeSquid may download vendor `content4.xml` and reload the merged database.
2. Custom rows from the Web UI are saved to the dev copy of `content4.xml` when the section is displayable.
3. The internal MIME engine uses the libmagic database from this directory for body type detection (also used by DLP, logging, and Response Types).
4. The request-time hooks are **not implemented** — list rows do not add or remove connection tags at request time in the current build.

<Warning>
  For live response labelling by MIME or extension, use [Response Types](/configuration/custom_settings/response_types). Content Signatures rows still matter for database maintenance, autocomplete in other sections (for example DLP), and libmagic setup.
</Warning>

### Global Enabled

When off, the section reports itself disabled — signature database download/reload and MIME library setup are affected. List rows are still persisted even when the request-time hooks are inactive.

### Subsections

* **Content Signatures List** — MIME regex rows plus tags to add. Stored in config; not applied on connections at request time today.
* **Content Categories List** — Category names for autocomplete and grouping in signature rows.
* **Content File Extensions** — Extension regex rows plus extension tags. The matching request-time hook is not implemented.

### Legacy UI options

Selectors such as **Transfer Encoding Chunk**, **multi-part byte-range**, and **Trace Entry** under Content Signatures are not bound to any template field in this tree — they have no effect here (the same labels on Response Types do affect matching).

## Schema fields

None of the fields below are matched against live traffic in the current build — see the warnings above.

### Global

* **`enabled`** — master switch for signature database download/reload and MIME-detection library setup. Entries you add are saved regardless of this setting.

### Content Signatures List

* **`enabled`** — off skips the entry on save or reload.
* **`comment`** — administrator note.
* **Mime type (`valueField`)** — a regex such as `^text/html` or `^image/`; blank represents all MIME types.
* **`add_content_signatures`** — the signature value(s) this entry defines.
* **category (`group`)** — category value(s) associated with this entry.

### Content Categories List

* **`enabled`**, **`comment`**, **`add_content_category`** — same fields as above, applied to a category definition rather than a signature.

### Content File Extensions

* **`enabled`**, **`comment`** — same fields as above.
* **File Extension (`valueField`)** — a regex; comma-separated patterns are combined as an OR, the same convention Response Types uses; blank represents all extensions.
* **`add_file_extensions`**, **`group`** — the extension value(s) this entry defines, and its category.

A category name does **not** require a matching entry in Content Categories List to be usable — that list exists only to populate autocomplete pickers.

## Examples

<Tip>
  ### Maintain a custom MIME tag for DLP autocomplete

  * Content Signatures List: Mime type `^application/x-custom`, Added Content Signatures `CustomApp`

  **Result:** tag name appears in DLP and UI pickers. Connection tags are not added automatically — pair with a Response Types row if policy must match live traffic.
</Tip>

<Tip>
  ### Policy on detected downloads (use Response Types)

  * Response Types: Content type `^application/zip`, Added Response Types `archive-download`

  **Result:** live traffic is tagged using response headers and libmagic-detected type; Access Profiles can match `archive-download`.
</Tip>

## How to verify

1. Check module stats / Reports for content signature load or download status.
2. After editing rows, confirm `content4.xml` under `/var/lib/safesquid/content_signatures/` updates.
3. For live tagging, verify `response_profiles` in Detailed logs, not content signature hooks.

## See also

* [Response Types](/configuration/custom_settings/response_types)
* [DLP](/configuration/real_time_content_security/dlp)
* [Application Signatures](/configuration/custom_settings/application_signatures)
* [Cloud / categorisation feeds](/configuration/start_here/cloud_feeds)
* [Logging and troubleshooting](/configuration/start_here/logging)