search

wp-media / wp-rocket

Performance optimization plugin for WordPress
https://wp-rocket.me
GNU General Public License v2.0
701 stars 218 forks source link

Remove charset=utf-8 parameter from application/json content type #3645

Closed MrPropre closed 3 years ago

MrPropre commented 3 years ago

Before submitting an issue please check that you’ve completed the following steps:

Describe the bug

As per IANA notes on media types https://www.iana.org/assignments/media-types/application/json the charset parameter has no effect on the content type application/json.

A user reported that Chrome started throwing CORB (Cross-Origin-Read-Blocking) warnings when the content type was set to application/json; charset=utf-8

https://github.com/slimphp/Slim/issues/2629#issue-433346498

Expected behavior

We need to remove ; charset=utf-8

The affected files are: https://github.com/wp-media/wp-rocket/blob/40ecc6c70de1995295a1994fb77a6ecb93885287/assets/js/wpr-cpcss.js#L88 https://github.com/wp-media/wp-rocket/blob/4290c82321b8d08fd20770e23822d9a9522ce8e2/tests/Fixtures/content/htaccessContent.php#L11 https://github.com/wp-media/wp-rocket/blob/4290c82321b8d08fd20770e23822d9a9522ce8e2/inc/functions/htaccess.php#L507

Backlog Grooming (for WP Media dev team use only)

remyperona commented 3 years ago

Hi @MrPropre,

Did you encounter the CORB warning when using the plugin?

MrPropre commented 3 years ago

Hello @Tabrisrp,

Not personally (I use Firefox) but I know that in most cases the warning can safely be ignored. Here is the documentation from Google: https://www.chromium.org/Home/chromium-security/corb-for-developers

A response served with a "X-Content-Type-Options: nosniff" response header and an incorrect "Content-Type" response header, may be blocked.

In most cases, the blocked response should not affect the web page's behavior and the CORB error message can be safely ignored.

It seems that adding ;charset=utf-8 to an application/json content type makes it incorrect due to Chrome's content type enhancement. Additionally, by checking IANA's site, we can see no charset parameter was ever actually defined in any RFC for the application/json type. It would be logical to remove it to stop the CORB warning on chrome, and to lighten the response size a bit.

Thank you.

remyperona commented 3 years ago

Thank you for your feedback.

I'm thinking we can safely remove this from the code in wpr-cpcss.js.

I have more doubts for the .htaccess file directives, so I would not touch this one for now.

remyperona commented 3 years ago

Scope a solution ✅

In assets/js/wpr-cpcss.js

Estimate the effort ✅

Effort [XS]