Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct mime-types for atom, rdf, and rss #50

Closed
wants to merge 3 commits into from

Conversation

gennadiylitvinyuk
Copy link

This solves some issues with nosniff header also.

atom: application/atom+xml (https://www.iana.org/assignments/media-types/media-types.xhtml)
rdf: application/rdf+xml (http://www.w3.org/2008/01/rdf-media-types)
rss: application/rss+xml (http://www.rssboard.org/rss-mime-type-application.txt)

This solves some issues with nosniff header also.

atom: application/atom+xml  (https://www.iana.org/assignments/media-types/media-types.xhtml)
rdf:    application/rdf+xml (http://www.w3.org/2008/01/rdf-media-types)
rss:   application/rss+xml (http://www.rssboard.org/rss-mime-type-application.txt)
@arthurvr
Copy link
Member

Seems like tests are failing? Could you take a look?

@gennadiylitvinyuk
Copy link
Author

Of course I could fix the tests...
The question is, whether the changes looks acceptable by maintainers... @mathiasbynens @drublic

@AD7six
Copy link
Member

AD7six commented Jan 7, 2015

Seems appropriate - but I can't merge it with failing tests =).

@AD7six AD7six added awaiting feedback Further information is requested enhancement New feature or request labels Jan 7, 2015
@gennadiylitvinyuk
Copy link
Author

@AD7six Found some time to fix tests.

@alrra alrra closed this Feb 7, 2015
@alrra
Copy link
Member

alrra commented Feb 7, 2015

@gennadiylitvinyuk Thanks for the pull request, however, the media types were intentionally set to application/xml, see h5bp/html5-boilerplate#989.

@alrra alrra removed awaiting feedback Further information is requested enhancement New feature or request labels Feb 7, 2015
@gennadiylitvinyuk
Copy link
Author

Hi @alrra,

I am a witness to a opposite function, compared to the described in h5bp/html5-boilerplate#989.

With nosniff header set, IE does not try to interpret application/xml as rss/atom/..., but downloads it directly. It is a sense of the nosniff-header.

So we should either set the nosniff-header and define mime-types correctly, or don't set it, and let browsers interpret it from application/xml, but not both in the same time.

@alrra
Copy link
Member

alrra commented Feb 26, 2015

@gennadiylitvinyuk Sorry for the delay on this.

With nosniff header set, IE does not try to interpret application/xml as rss/atom/..., but downloads it directly. It is a sense of the nosniff-header.

@gennadiylitvinyuk I could not reproduce that using the configurations that currently exist in this repository. In my tests, the files where display as intended in all versions of Internet Explorer.

Browser (OS) .atom .rdf .rss
IE 6
(WIndows XP)
IE 7
(WIndows XP)
IE 8
(WIndows XP)
IE 9
(WIndows 7)
IE 10
(WIndows 7)
IE 11
(WIndows 7)

@alrra alrra closed this Feb 26, 2015
@gennadiylitvinyuk
Copy link
Author

Hi @alrra

You has obviously shown the unintended behavior.

The IE will download any resource, if it does not know how to process it, and nosniff is set.

Please see: http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx

If you set plain/text with nosniff to a html file, you will see/download source code of the file (since IE8) but you will not get it interpreted as a HTML. The same is with images served as binary...

The changes were intended to let IE interpret file types it could, and show them correctly with provided processors, for example interpret rss/atom feed and show them correctly (see IE7 screenshots, it simply ignores nosniff, ie8+ does not interpret them anymore)

@mathiasbynens
Copy link
Member

@gennadiylitvinyuk I don’t understand what you’re getting at. @alrra’s screenshots show that IE knows how to process the files with the current MIME types. Why would displaying the feed in the browser be the unintended behavior?

@hatzopoulos
Copy link
Contributor

@mathiasbynens

From the looks of it, I believe what @gennadiylitvinyuk means is that when IE loads an RSS feed it tries to sniff the content so it's RSS previewer kicks in and nosniff included in the header will cause IE to simply show the 'unstyled' raw feed rather then the Microsoft Preview. Which one might consider a bad user experience.

The tests from h5bp/html5-boilerplate#989 were not done in Windows as the tester did not have them on hand at the time but @alrra has done them now with the nosniff header in place. And IE7 seems to wrongly ignore the header and parses the page in it's native RSS viewer. Where as the others do what they're told? So is this the desired effect?

For example IE11 loads an RSS feed like https://developer.apple.com/news/rss/news.rss and renders it something like below but with the nosniff header IE just displays the raw source. FWIW apple.com was sending Content-Type:application/rss+xml; charset=UTF-8 without nosniff in the screenshot below.

image

Seems like the mime type has to be in the style of application/atom+xml for IE to do it's RSS preview, and when nosniff is set it won't try MIME-sniffing the response away from the declared content-type.

@alrra
Copy link
Member

alrra commented Feb 28, 2015

@hatzopoulos Thank you for your comment!

The IE will download any resource...

@gennadiylitvinyuk In the future please try to be more clear (e.g.: I also interpreted "IE will download" as IE will open the download prompt).

I did some more tests (see below), and it seems that it is in general ok to change the media types for .atom and .rss, but not for .rdf.

Note: After this change, the only minor issue will be that IE 6 users will get the download prompt for .atom and .rss files, but that isn't really a big problem nowadays.

@alrra
Copy link
Member

alrra commented Feb 28, 2015

  • .atom, .rdf and .rss served with their appropriate media types

    Browser (OS) .atom .rdf .rss
    Chrome 40
    (OS X 10.10.2)
    Chrome 40 (Android 4.3.0)
    Firefox 36
    (OS X 10.10.2)
    IE 6
    (Windows XP)
    IE 7
    (Windows XP)
    IE 8
    (Windows XP)
    IE 9
    (Windows 7)
    IE 10
    (Windows 7)
    IE 11
    (Windows 7)
    Safari 8.0.3
    (OS X 10.10.2)
    Safari
    (iOS 8.1.3)
  • .atom, .rdf and .rss served with their appropriate media types + X-Content-Type-Options: "nosniff" header

    Browser (OS) .atom .rdf .rss
    Chrome 40
    (OS X 10.10.2)
    Chrome 40 (Android 4.3.0)
    Firefox 36
    (OS X 10.10.2)
    IE 6
    (Windows XP)
    IE 7
    (Windows XP)
    IE 8
    (Windows XP)
    IE 9
    (Windows 7)
    IE 10
    (Windows 7)
    IE 11
    (Windows 7)
    Safari 8.0.3
    (OS X 10.10.2)
    Safari
    (iOS 8.1.3)
  • .atom, .rdf and .rss served with the application/xml media type

    Browser (OS) .atom .rdf .rss
    Chrome 40
    (OS X 10.10.2)
    Chrome 40 (Android 4.3.0)
    Firefox 36
    (OS X 10.10.2)
    IE 6
    (Windows XP)
    IE 7
    (Windows XP)
    IE 8
    (Windows XP)
    IE 9
    (Windows 7)
    IE 10
    (Windows 7)
    IE 11
    (Windows 7)
    Safari 8.0.3
    (OS X 10.10.2)
    Safari
    (iOS 8.1.3)
  • .atom, .rdf and .rss served with the application/xml media type + X-Content-Type-Options: "nosniff" header

    Browser (OS) .atom .rdf .rss
    Chrome 40
    (OS X 10.10.2)
    Chrome 40 (Android 4.3.0)
    Firefox 36
    (OS X 10.10.2)
    IE 6
    (Windows XP)
    IE 7
    (Windows XP)
    IE 8
    (Windows XP)
    IE 9
    (Windows 7)
    IE 10
    (Windows 7)
    IE 11
    (Windows 7)
    Safari 8.0.3
    (OS X 10.10.2)
    Safari
    (iOS 8.1.3)

Notes:

  • Opera behaved exactly like Chrome
  • The default Browser for Android 4.3.0 (Samsung Galaxy S3) behaved the same for all cases:

@alrra alrra reopened this Feb 28, 2015
@alrra alrra closed this in 653c461 Mar 2, 2015
alrra pushed a commit to h5bp/server-configs-nginx that referenced this pull request Mar 19, 2015
Modify the configurations so that:

 * `.atom` files are served with the `application/atom+xml`¹ media type
 * `.rss` files are served with the `application/rss+xml`² media type

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

¹ https://www.iana.org/assignments/media-types/application/atom+xml
² http://tools.ietf.org/id/draft-nottingham-rss-media-type-00.txt

Ref: h5bp/server-configs-apache#50 (comment)
     h5bp/server-configs-apache@653c461

Close #90
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants