In more detail
Servers send the MIME type in the Content-Type header, and email attachments use it too (MIME stands for Multipurpose Internet Mail Extensions). The top-level types are text, image, audio, video, font, application and multipart, and parameters can follow, such as charset=utf-8. application/octet-stream means "arbitrary binary data" and usually triggers a download. Browsers may guess ("sniff") a type from the content; the header X-Content-Type-Options: nosniff turns that off.
Why it matters
A wrong type can make a page show as plain text or a script refuse to run. An upload form that trusts the type the browser reports can be tricked into storing HTML or script disguised as an image, so check the actual bytes, the file's magic bytes, instead.
Example
A JSON API response:
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Common pairs: .html → text/html, .css → text/css, .js → text/javascript, .png → image/png, .pdf → application/pdf. See MIME Types Cheat Sheet for more.
Common confusion
A file extension is only a naming convention, and magic bytes are inside the file; the MIME type is the label sent with it, and the three can disagree.