[whatwg/fetch] What is the right destination type for non-JS modules? (#967)

In the now-reverted [JSON module PR](https://github.com/whatwg/html/pull/4407) in HTML, the request destination was (accidentally) "script". As [discussed in the PR](https://github.com/whatwg/html/pull/4407#issuecomment-552691940), this is probably a bug: If the server responds with nosniff headers, then the response will be rejected, since the JSON MIME types are not JS MIME types.

In that JSON module PR, the general model was that the server would respond with a MIME type that indicates the module type; the client doesn't know what type the module will be until it gets the response, so of course it would use the "script" destination. However, with the discussion in https://github.com/w3c/webcomponents/issues/839, and the [TC39 module attributes proposal](https://github.com/littledan/proposal-module-attributes/), it's possible that the client *would* indicate something about what kind of module it's expecting back. This could feed into the destination.

In general, what destinations should we use for non-JS module types, such as WebAssembly modules, HTML modules, CSS modules, and JSON modules?

I see two general paths:
- Keep using the script-like destinations, and add a special internal flag to prevent the nosniff issue
- Make the requested module type part of the destination, or part of some other request parameter

Some considerations:
- The destination is visible to the Web in `<link rel=modulepreload>` (which currently requires a script-like destination) as well as in the destination attribute in Requests in ServiceWorker.
- We may want a Worker or Worklet to run WebAssembly directly, as their entrypoint. So if WebAssembly had its own destination, we might want to also make wasm-worker, wasm-serviceworker, wasm-paintworklet, etc destinations. (I imagine the non-executable module types wouldn't need to indicate the environment.)

Thoughts?

(thanks to @annevk and @slightlyoff in explaining a bunch of these concepts to me.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/967