diff --git a/fetch.bs b/fetch.bs index cf6a8eaaa..5975a1f3a 100755 --- a/fetch.bs +++ b/fetch.bs @@ -4306,6 +4306,14 @@ X-Content-Type-Options = "nosniff" ; case-insensitive
  • Let destination be request's destination. +

    +

    The X-Content-Type-Options header requires a strict MIME type match. For + example, if a server returns a script with X-Content-Type-Options set to + "nosniff" but the Content-Type header is text/plain or + missing entirely, the user agent will block the response. +

    + +
  • If destination is script-like and mimeType is failure or is not a JavaScript MIME type, then return blocked. @@ -10208,6 +10216,7 @@ done only by navigations). The fetch controller is also used to

    Acknowledgments

    Thanks to +Sneha Lata Adam Barth, Adam Lavin, Alan Jeffrey,