Re: [whatwg/fetch] Restrict allowed JavaScript MIME types (#870)

> That number is incredibly high. Sadly you don't seem to count `application/json`? Would this also include no Content-Type?

Yes. "Other" is everything else, including `application/json` and the empty string.

> Would you assume that breaking cross-origin scripts would usually be less of a problem, assuming that a lot of those are tracking scripts?

Yes, that's exactly my intuition. Hence the separate metrics. :)

> I am still surprised that the difference seems so high, but I don't have a good intuition on how those two measurements compare.

I can imagine that Chromium's page-views-based number would look much higher than Mozilla's script-load-based number if there are a small number of very widely used scripts with incorrect MIME types. Facebook was in this category, as is VK, and a zillion ad scripts.

I think it's worth experimenting in this direction, and explicitly allowing `text/html` and `application/json` probably takes care of a large chunk of the potential breakage, but I think it'll be necessary to do some more research before I'd be able to convince Blink folks to ship this kind of change.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/870#issuecomment-462250891