From c878c4de644c9f3bb849ea3196cc0f838828ca01 Mon Sep 17 00:00:00 2001 From: snehalata2027 Date: Sun, 26 Apr 2026 17:59:01 +0530 Subject: [PATCH 1/2] Add example for strict nosniff matching --- fetch.bs | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fetch.bs b/fetch.bs index cf6a8eaaa..6145a0297 100755 --- a/fetch.bs +++ b/fetch.bs @@ -4306,6 +4306,14 @@ X-Content-Type-Options = "nosniff" ; case-insensitive
  • Let destination be request's destination. +

    +

    The X-Content-Type-Options header requires a strict MIME type match. For + example, if a server returns a script with X-Content-Type-Options set to + "nosniff" but the Content-Type header is text/plain or + missing entirely, the user agent will block the response. +

    + +
  • If destination is script-like and mimeType is failure or is not a JavaScript MIME type, then return blocked. From 38bfd9e8fd9339ddab6080895e43cdcffb373325 Mon Sep 17 00:00:00 2001 From: snehalata2027 Date: Sun, 26 Apr 2026 18:01:29 +0530 Subject: [PATCH 2/2] Add example for strict nosniff matching --- fetch.bs | 1 + 1 file changed, 1 insertion(+) diff --git a/fetch.bs b/fetch.bs index 6145a0297..5975a1f3a 100755 --- a/fetch.bs +++ b/fetch.bs @@ -10216,6 +10216,7 @@ done only by navigations). The fetch controller is also used to

    Acknowledgments

    Thanks to +Sneha Lata Adam Barth, Adam Lavin, Alan Jeffrey,