search

whatwg / mimesniff

MIME Sniffing Standard
https://mimesniff.spec.whatwg.org/
Other
109 stars 44 forks source link

How are font MIME types exposed in the web platform? #60

Open annevk opened 6 years ago

annevk commented 6 years ago

We have sniffing for fonts, but as far as I know we only use that to determine which font parser to use, and we don't really need MIME types for that. (E.g., X-Content-Type-Options is ignored for fonts.)

cc @svgeesus

annevk commented 6 years ago

See also https://github.com/whatwg/mimesniff/issues/23#issuecomment-341326076.

domenic commented 6 years ago

What would you use instead of MIME types?

annevk commented 6 years ago

The question is really how many places sniff. If this is all local to the font loader, it could just perform the sniffing and dispatch to the appropriate parser algorithm. You shouldn't need a MIME type to find a parser algorithm, generally.

domenic commented 6 years ago

I think it's still useful to use MIME types as the canonical label for given parsers, even if they're not exposed to web developers.

We could call this spec the "resource sniffer algorithm" and make up our own ad-hoc labels for each format/parser, but that doesn't seem like a useful thing to do when MIME types already exist.

annevk commented 6 years ago

Maybe, I'm still a little unsure if font sniffing should be in this specification at all if the only caller is the font loader. Though maybe it makes more sense with the cross-origin thingy Chrome is working on?

svgeesus commented 5 years ago

Is there a conclusion on font MIME type sniffing? @annevk If it is not used, should this issue be closed?

btw Font MIME types defined in RFC 8081: The "font" Top-Level Media Type

annevk commented 5 years ago

Tentatively, since fonts always use CORS, it matters less that they are sniffed for CORB/Spectre purposes. The actual sniffing should be defined as part of the font loader I think, which I guess would be part of some CSS font specification.