life without MIME type sniffing?
Author(s) and publish date
- By:
-
-
Dan Connolly
-
- Published:
In a recent item on IE8 Security, Eric Lawrence, Security Program Manager for Internet Explorer, introduced a work-around to the security risks associated with content-type sniffing: an authoritative=true parameter on the Content-Type header in HTTP. This re-started discussion of the content-type sniffing rules and the Support Existing Content design principle of HTML 5. In response to a challenge asking for evidence that supporting existing content requires sniffing, Adam made a suggestion that I'd like to pass along:
I encourage you to build a copy of Firefox without content sniffing and try surfing the web. I tried this for a while, and I remember there being a lot of broken sites ...
That reminded me of an idea I heard in TAG discussions of MIME types and error recovery: a browser mode for "This is my content, show me problems rather than fixing them for me silently."
Though Adam offered a patch, building firefox is not something I have mastered yet, so I'm interested to learn about run-time configuration options in IE (notes Julian) and Opera (notes Michael). Eric Lawrence's reply points out:
Please do keep in mind, however, that most folks (even the ultra-web engaged on these lists) see but a small fraction of the web, especially considering private address space/intranets, etc.
A report from one developer suggests there's light at the end of the tunnel, at least for sniffing associated with feeds:
I did, partly as an experiment, stop sniffing text/plain in the latest release of SimplePie (which, inevitably, isn't the nicest of things to do, seeming there are tens of thousands of users). Next to nothing broke. I know for a fact this couldn't have been done a year or two ago: things have certainly moved on in terms of the MIME types feeds are served with ...
If you get a chance to try life without MIME type sniffing, please let us know how it goes.
Also, to say something I said later in that email (that Dan didn't quote), text/html sniffing (to see whether it is a feed or HTML) is certainly needed still, but as far as I've seen, that's the only bit of sniffing still needed (the other thing needed with regard to content-type on HTTP needed still is to only use the last Content-Type header, and to not concatenate them together as you would normally). The only sniffing I think can now be done without is (most) text/plain sniffing (you still need to have special treatment if it isn't the character set it claims to be).