diff --git a/fetch.bs b/fetch.bs index cf6a8eaaa..5975a1f3a 100755 --- a/fetch.bs +++ b/fetch.bs @@ -4306,6 +4306,14 @@ X-Content-Type-Options = "nosniff" ; case-insensitive
Let destination be request's destination. +
The X-Content-Type-Options header requires a strict MIME type match. For
+ example, if a server returns a script with X-Content-Type-Options set to
+ "nosniff" but the Content-Type header is text/plain or
+ missing entirely, the user agent will block the response.
+
If destination is script-like and mimeType is failure or is not a JavaScript MIME type, then return blocked. @@ -10208,6 +10216,7 @@ done only by navigations). The fetch controller is also used to
Thanks to +Sneha Lata Adam Barth, Adam Lavin, Alan Jeffrey,