{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/35","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/35/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/35/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/35/events","html_url":"https://github.com/whatwg/fetch/issues/35","id":65901838,"number":35,"title":"Standardize \"nosniff\"","user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-04-02T10:43:48Z","updated_at":"2015-04-07T01:44:15Z","closed_at":"2015-04-03T09:06:55Z","body":"Research:\r\n\r\n* https://lists.w3.org/Archives/Public/public-webappsec/2015Apr/0004.html\r\n* https://lists.w3.org/Archives/Public/public-webappsec/2015Apr/0005.html\r\n\r\nTodo:\r\n\r\n* Study various other contexts.\r\n* Fix tests to match the web-platform-tests framework.\r\n\r\nTentative plan:\r\n\r\n* Define the `X-Content-Type-Options` header.\r\n* Add a hook in #concept-fetch that checks a response for \"nosniff\" violations. If there are violations, return a network error instead.\r\n* Write a section that defines the check for \"nosniff\" violations. Checking the request context against the MIME type if a \"nosniff\" header is around.\r\n\r\nOpen issue:\r\n\r\n* Might need to annotate the response with a \"nosniff\" flag of sorts so further checks can be done by special components. E.g. an image decoder might want to reject a GIF with a image/png MIME type (IE11 does this)."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/90308320","html_url":"https://github.com/whatwg/fetch/issues/35#issuecomment-90308320","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/35","id":90308320,"user":{"login":"mnot","id":74384,"avatar_url":"https://avatars.githubusercontent.com/u/74384?v=3","gravatar_id":"","url":"https://api.github.com/users/mnot","html_url":"https://github.com/mnot","followers_url":"https://api.github.com/users/mnot/followers","following_url":"https://api.github.com/users/mnot/following{/other_user}","gists_url":"https://api.github.com/users/mnot/gists{/gist_id}","starred_url":"https://api.github.com/users/mnot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mnot/subscriptions","organizations_url":"https://api.github.com/users/mnot/orgs","repos_url":"https://api.github.com/users/mnot/repos","events_url":"https://api.github.com/users/mnot/events{/privacy}","received_events_url":"https://api.github.com/users/mnot/received_events","type":"User","site_admin":false},"created_at":"2015-04-07T01:44:15Z","updated_at":"2015-04-07T01:44:15Z","body":"Yep, that RFC is for new things, *not* existing things. If you need to make a breaking change on one of those headers, that's your opportunity to change the name, but don't do it just to change the name; that's a worse outcome."}}