Re: [whatwg/fetch] More CORB-protected MIME types - safelist-based approach (#721)

For option 2 (sniffing) @acolwell also points out that sniffing is challenging for range requests (which have to be supported for media content).  FWIW, the current CORB implementation treats responses to range requests as if the `X-Content-Type-Options: nosniff` response header was present.

And I would also like to point out that sniffing should ideally be based on the first X bytes of the response (right not Chromium sniffing only looks at most at the first 1024 bytes to avoid increasing the latency).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/721#issuecomment-468395322