xp-forge / frontend

Web frontends
1 stars 1 forks source link

Deliver text files, JSON, XML and JavaScript with `charset=utf-8` #23

Closed thekid closed 3 years ago

thekid commented 3 years ago

Motivation

image

Why is that important?

Even though browsers sometimes ignore the value of the Content-Type header and try to sniff the content (see also: X-Content-Type-Options hint), it’s indicated to always send the appropriate media type and charset for the response as, among other:

  • the media type defines both the data format and how that data is intended to be processed by browsers
  • not sending the appropriate charset, where appropriate, may prevent things from being rendered correctly thus creating a bad user experience (see also: meta-charset-utf-8 hint)
  • javascript resources served with the wrong media type may be blocked

See https://webhint.io/docs/user-guide/hints/hint-content-type/

thekid commented 3 years ago

Views are already sent with a charset in the content type, see here:

https://github.com/xp-forge/frontend/blob/a6349228938a2d80357d33337606b5c10d5ea0fd/src/main/php/web/frontend/View.class.php#L118

However, we could use xp::ENCODING here instead of hard-wiring it.

thekid commented 3 years ago

https://webhint.io/docs/user-guide/server-configurations/apache/ lists the following file extensions for adding utf-8 to:

Extension util.MimeType::getByFileName() Action
.appcache text/cache-manifest text/*
.atom application/atom+xml Listed
.css text/css text/*
.js application/javascript Listed
.json application/json Listed
.manifest text/cache-manifest text/*
.map application/json Listed
.mjs application/javascript Listed
.rdf application/rdf+xml Listed
.rss application/rss+xml Listed
.vtt text/vtt text/*
.webmanifest application/manifest+json Listed
.xml application/xml Listed

https://webhint.io/docs/user-guide/server-configurations/iis/ includes image/svg+xml to include in this list.

We could also extend the rule to include application/*+xml and application/*+json, which would make the rule more generic.

thekid commented 3 years ago

I'm a bit reluctant to automatically set a charset parameter for XML documents, as they typically start with this line:

<?xml version="1.0" encoding="UTF-8"?>

...and this may create the situation where our Content-Type header says one thing and the XML file says something different. On the other hand, no one in his or her right mind would deliver XML files with anything other than utf-8 today, would they?

See also https://stackoverflow.com/questions/3272534/what-content-type-value-should-i-send-for-my-xml-sitemap

thekid commented 3 years ago

Released in https://github.com/xp-forge/frontend/releases/tag/v3.3.0