idnits 2.17.1 draft-ietf-dispatch-javascript-mjs-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (February 22, 2021) is 1158 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- ** Obsolete normative reference: RFC 4329 (Obsoleted by RFC 9239) Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 DISPATCH M. Miller 3 Internet-Draft 4 Obsoletes: 4329 (if approved) M. Borins 5 Intended status: Informational GitHub 6 Expires: August 26, 2021 M. Bynens 7 Google 8 B. Farias 9 February 22, 2021 11 ECMAScript Media Types Updates 12 draft-ietf-dispatch-javascript-mjs-08 14 Abstract 16 This document updates the ECMAScript media types, replacing the 17 existing registrations for "application/javascript" and "text/ 18 javascript" with information and requirements aligned with 19 implementation experiences. This document obsoletes RFC4329, 20 "Scripting Media Types". 22 Status of This Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at https://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on August 26, 2021. 39 Copyright Notice 41 Copyright (c) 2021 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (https://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 57 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 58 2. Compatibility . . . . . . . . . . . . . . . . . . . . . . . . 3 59 3. Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 60 4. Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . 4 61 4.1. Charset Parameter . . . . . . . . . . . . . . . . . . . . 5 62 4.2. Character Encoding Scheme Detection . . . . . . . . . . . 5 63 4.3. Character Encoding Scheme Error Handling . . . . . . . . 6 64 5. Security Considerations . . . . . . . . . . . . . . . . . . . 6 65 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 66 6.1. Common Javascript Media Types . . . . . . . . . . . . . . 9 67 6.1.1. text/javascript . . . . . . . . . . . . . . . . . . . 9 68 6.2. Historic Javascript Media Types . . . . . . . . . . . . . 10 69 6.2.1. application/ecmascript . . . . . . . . . . . . . . . 10 70 6.2.2. application/javascript . . . . . . . . . . . . . . . 11 71 6.2.3. application/x-ecmascript . . . . . . . . . . . . . . 12 72 6.2.4. application/x-javascript . . . . . . . . . . . . . . 13 73 6.2.5. text/ecmascript . . . . . . . . . . . . . . . . . . . 14 74 6.2.6. text/javascript1.0 . . . . . . . . . . . . . . . . . 15 75 6.2.7. text/javascript1.1 . . . . . . . . . . . . . . . . . 16 76 6.2.8. text/javascript1.2 . . . . . . . . . . . . . . . . . 17 77 6.2.9. text/javascript1.3 . . . . . . . . . . . . . . . . . 18 78 6.2.10. text/javascript1.4 . . . . . . . . . . . . . . . . . 19 79 6.2.11. text/javascript1.5 . . . . . . . . . . . . . . . . . 20 80 6.2.12. text/jscript . . . . . . . . . . . . . . . . . . . . 21 81 6.2.13. text/livescript . . . . . . . . . . . . . . . . . . . 22 82 6.2.14. text/x-ecmascript . . . . . . . . . . . . . . . . . . 23 83 6.2.15. text/x-javascript . . . . . . . . . . . . . . . . . . 24 84 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 25 85 7.1. Normative References . . . . . . . . . . . . . . . . . . 25 86 7.2. Informative References . . . . . . . . . . . . . . . . . 26 87 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 26 88 Appendix B. Changes from RFC 4329 . . . . . . . . . . . . . . . 26 89 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27 91 1. Introduction 93 This memo describes media types for the JavaScript and ECMAScript 94 programming languages. Refer to the sections "Introduction" and 95 "Overview" in [ECMA-262] for background information on these 96 languages. This document updates the descriptions and registrations 97 for these media types to reflect existing usage on the Internet. 99 This document replaces the media types registrations in [RFC4329], 100 obsoleting that document. 102 1.1. Terminology 104 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 105 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 106 "OPTIONAL" in this document are to be interpreted as described in BCP 107 14 [RFC2119] [RFC8174] when, and only when, they appear in all 108 capitals, as shown here. 110 2. Compatibility 112 This document defines equivalent processing requirements for the 113 types text/javascript, text/ecmascript, and application/javascript. 114 The most widely supported media type in use is text/javascript; all 115 others are considered historical and obsolete compared to text/ 116 javascript. Differences in ECMAScript versions have been better 117 dealt with in the processors. 119 The types defined in this document are applicable to scripts written 120 in [ECMA-262]. This document does not address scripts written in 121 other languages. In particular, future editions of [ECMA-262] and 122 extensions to [ECMA-262] are not directly addressed. 124 This document may be updated to take other content into account. 125 Updates of this document may introduce new optional parameters; 126 implementations MUST consider the impact of such an update. 128 The definitions in this document reflect the current state of 129 implementation across the JavaScript ecosystem, in web browsers and 130 other environments such as Node.js alike, in order to guarantee 131 backwards compatibility with existing applications as much as 132 possible. 134 3. Modules 136 In order to formalize support for modular programs, [ECMA-262] 137 (starting with 6th Edition) defines two top-level goal symbols (or 138 roots to the abstract syntax tree) for the ECMAScript grammar: Module 139 and Script. The Script goal represents the original structure where 140 the code executes in the global scope, while the Module goal 141 represents the module system built into ECMAScript starting with 6th 142 Edition. See the section "ECMAScript Language: Scripts and Modules" 143 of [ECMA-262] for details. 145 This separation means that (in the absence of additional information) 146 there are two possible interpretations for any given ECMAScript 147 Source Text. The TC39 standards body for ECMAScript has determined 148 that media types are outside of their scope of work 149 [TC39-MIME-ISSUE]. 151 It is not possible to fully determine if a Source Text of ECMAScript 152 is meant to be parsed in the Module or Script grammar goals based 153 upon content alone. Therefore, scripting environments MUST use out 154 of band information in order to determine what goal a Source Text 155 should be treated as. To this end some scripting environments have 156 chosen to adopt the new file extension of .mjs for this purpose. 158 This document does not define how fragment identifiers in resource 159 identifiers ([RFC3986], [RFC3987]) for documents labeled with one of 160 the media types defined in this document are resolved. An update of 161 this document may define processing of fragment identifiers. 163 4. Encoding 165 Refer to [RFC6265] for a discussion of terminology used in this 166 section. Source text (as defined in [ECMA-262], section "Source 167 Text") can be binary source text. Binary source text is a textual 168 data object that represents source text encoded using a character 169 encoding scheme. A textual data object is a whole text protocol 170 message or a whole text document, or a part of it, that is treated 171 separately for purposes of external storage and retrieval. An 172 implementation's internal representation of source text and source 173 text are not considered binary source text. 175 Implementations need to determine a character encoding scheme in 176 order to decode binary source text to source text. The media types 177 defined in this document allow an optional charset parameter to 178 explicitly specify the character encoding scheme used to encode the 179 source text. 181 How implementations determine the character encoding scheme can be 182 subject to processing rules that are out of the scope of this 183 document. For example, transport protocols can require that a 184 specific character encoding scheme is to be assumed if the optional 185 charset parameter is not specified, or they can require that the 186 charset parameter is used in certain cases. Such requirements are 187 not considered part of this document. 189 Implementations that support binary source text MUST support binary 190 source text encoded using the UTF-8 [RFC3629] character encoding 191 scheme. Module goal sources MUST be encoded as UTF-8, all other 192 encodings will fail. Source goal sources SHOULD be encoded as UTF-8; 193 other character encoding schemes MAY be supported, but are 194 discouraged. 196 4.1. Charset Parameter 198 The charset parameter provides a means to specify the character 199 encoding scheme of binary source text. Its value MUST match the 200 mime-charset production defined in [RFC2978], section 2.3, and SHOULD 201 be a registered charset [CHARSETS]. An illegal value is a value that 202 does not match that production. 204 The charset parameter is only used when processing a Script goal 205 source; Module goal sources MUST always be processed as UTF-8. 207 4.2. Character Encoding Scheme Detection 209 It is possible that implementations cannot interoperably determine a 210 single character encoding scheme simply by complying with all 211 requirements of the applicable specifications. To foster 212 interoperability in such cases, the following algorithm is defined. 213 Implementations apply this algorithm until a single character 214 encoding scheme is determined. 216 1. If the binary source text is not already determined to be a 217 Module goal and starts with a Unicode encoding form signature, 218 the signature determines the encoding. The following octet 219 sequences, at the very beginning of the binary source text, are 220 considered with their corresponding character encoding schemes: 222 +------------------+----------+ 223 | Leading sequence | Encoding | 224 |------------------+----------| 225 | EF BB BF | UTF-8 | 226 | FF FE | UTF-16LE | 227 | FE FF | UTF-16BE | 228 +------------------+----------+ 230 Implementations of this step MUST use these octet sequences to 231 determine the character encoding scheme, even if the determined 232 scheme is not supported. If this step determines the character 233 encoding scheme, the octet sequence representing the Unicode 234 encoding form signature MUST be ignored when decoding the binary 235 source text. 237 2. If a charset parameter with a legal and understood value is 238 specified, the value determines the character encoding scheme. 240 3. If no other character encoding scheme is determined from the 241 previous steps, it is assumed to be UTF-8. 243 If the character encoding scheme is determined to be UTF-8 through 244 any means other than step 1 as defined above and the binary source 245 text starts with the octet sequence EF BB BF, the octet sequence is 246 ignored when decoding the binary source text. 248 4.3. Character Encoding Scheme Error Handling 250 Binary source text that is not properly encoded for the determined 251 character encoding can pose a security risk, as discussed in section 252 5. That said, because of the varied and complex environments scripts 253 are executed in, most of the error handling specifics are left to the 254 processors. The following are broad guidelines that processors 255 follow. 257 If binary source text is determined to have been encoded using a 258 certain character encoding scheme that the implementation is unable 259 to process, implementations can consider the resource unsupported 260 (i.e., do not decode the binary source text using a different 261 character encoding scheme). 263 Binary source text can be determined to have been encoded using a 264 certain character encoding scheme but contain octet sequences that 265 are not legal according to that scheme. Implementations can 266 substitute those illegal sequences with the replacement character 267 U+FFFD (properly encoded for the scheme), or stop processing 268 altogether. 270 5. Security Considerations 272 Refer to [RFC3552] for a discussion of terminology used in this 273 section. Examples in this section and discussions of interactions of 274 host environments with scripts, modules, and extensions to [ECMA-262] 275 are to be understood as non-exhaustive and of a purely illustrative 276 nature. 278 The programming language defined in [ECMA-262] is not intended to be 279 computationally self-sufficient, rather it is expected that the 280 computational environment provides facilities to programs to enable 281 specific functionality. Such facilities constitute unknown factors 282 and are thus considered out of the scope of this document. 284 Derived programming languages are permitted to include additional 285 functionality that is not described in [ECMA-262]; such functionality 286 constitutes an unknown factor and is thus considered out of the scope 287 of this document. In particular, extensions to [ECMA-262] defined 288 for the JavaScript programming language are not discussed in this 289 document. 291 Uncontrolled execution of scripts can be exceedingly dangerous. 292 Implementations that execute scripts MUST give consideration to their 293 application's threat models and those of the individual features they 294 implement; in particular, they MUST ensure that untrusted content is 295 not executed in an unprotected environment. 297 Module scripts in ECMAScript can request the fetching and processing 298 of additional scripts, called importing. Implementations that 299 support modules need to process imported sources in the same way 300 scripts. Further, there may be additional privacy and security 301 concerns depending on the location(s) the original script and its 302 imported modules are obtained from. For instance, a script obtained 303 from "host-a.example" could request to import a script from "host- 304 b.example", which could expose information about the executing 305 environment (e.g., IP address) to "host-b.example". See the section 306 "ECMAScript Language: Scripts and Modules" in [ECMA-262] for details. 308 Specifications for host environment facilities and for derived 309 programming languages should include security considerations. If an 310 implementation supports such facilities, the respective security 311 considerations apply. In particular, if scripts can be referenced 312 from or included in specific document formats, the considerations for 313 the embedding or referencing document format apply. 315 For example, scripts embedded in application/xhtml+xml [RFC3236] 316 documents could be enabled through the host environment to manipulate 317 the document instance, which could cause the retrieval of remote 318 resources; security considerations regarding retrieval of remote 319 resources of the embedding document would apply in this case. 321 This circumstance can further be used to make information, that is 322 normally only available to the script, available to a web server by 323 encoding the information in the resource identifier of the resource, 324 which can further enable eavesdropping attacks. Implementation of 325 such facilities is subject to the security considerations of the host 326 environment, as discussed above. 328 The programming language defined in [ECMA-262] does include 329 facilities to loop, cause computationally complex operations, or 330 consume large amounts of memory; this includes, but is not limited 331 to, facilities that allow dynamically generated source text to be 332 executed (e.g., the eval() function); uncontrolled execution of such 333 features can cause denial of service, which implementations MUST 334 protect against. 336 With the addition of SharedArrayBuffer objects in ECMAScript version 337 8, it could be possible to implement a high-resolution timer which 338 could lead to certain types of timin`g and side-channel attacks 339 (e.g., [SPECTRE]). Implementations can take steps to mitigate this 340 concern, such as disabling or removing support for SharedArrayBuffer 341 objects, or take additional steps to ensure access to this shared 342 memory is only accessible between execution contexts that have some 343 form of mutual trust. 345 A host environment can provide facilities to access external input. 346 Scripts that pass such input to the eval() function or similar 347 language features can be vulnerable to code injection attacks. 348 Scripts are expected to protect against such attacks. 350 A host environment can provide facilities to output computed results 351 in a user-visible manner. For example, host environments supporting 352 a graphical user interface can provide facilities that enable scripts 353 to present certain messages to the user. Implementations MUST take 354 steps to avoid confusion of the origin of such messages. In general, 355 the security considerations for the host environment apply in such a 356 case as discussed above. 358 Implementations are required to support the UTF-8 character encoding 359 scheme; the security considerations of [RFC3629] apply. Additional 360 character encoding schemes may be supported; support for such schemes 361 is subject to the security considerations of those schemes. 363 Source text is expected to be in Unicode Normalization Form C. 364 Scripts and implementations MUST consider security implications of 365 unnormalized source text and data. For a detailed discussion of such 366 implications refer to the security considerations in [RFC3629]. 368 Scripts can be executed in an environment that is vulnerable to code 369 injection attacks. For example, a CGI script [RFC3875] echoing user 370 input could allow the inclusion of untrusted scripts that could be 371 executed in an otherwise trusted environment. This threat scenario 372 is subject to security considerations that are out of the scope of 373 this document. 375 The "data" resource identifier scheme [RFC2397], in combination with 376 the types defined in this document, could be used to cause execution 377 of untrusted scripts through the inclusion of untrusted resource 378 identifiers in otherwise trusted content. Security considerations of 379 [RFC2397] apply. 381 Implementations can fail to implement a specific security model or 382 other means to prevent possibly dangerous operations. Such failure 383 could possibly be exploited to gain unauthorized access to a system 384 or sensitive information; such failure constitutes an unknown factor 385 and is thus considered out of the scope of this document. 387 6. IANA Considerations 389 The media type registrations herein are divided into two major 390 categories: the sole media type "text/javascript" which is now in 391 common usage, and all of the media types that are obsolete. 393 For both categories, The ECMAScript media types are to be updated to 394 point to a non-vendor specific standard undated specification of 395 ECMAScript. In addition, a new file extension of .mjs is to be added 396 to the list of file extensions with the restriction that it must 397 correspond to the Module grammar of [ECMA-262]. Finally, the [HTML] 398 specification uses "text/javascript" as the default media type of 399 ECMAScript when preparing script tags; therefore, "text/javascript" 400 intended usage is to be moved from OBSOLETE to COMMON. 402 6.1. Common Javascript Media Types 404 6.1.1. text/javascript 406 Type name: text 408 Subtype name: javascript 410 Required parameters: N/A 412 Optional parameters: charset, see section 4.1 of [this document]. 414 Encoding considerations: Binary 416 Security considerations: See section 5 of [this document].. 418 Interoperability considerations: See various sections of [this 419 document]. 421 Published specification: [this document] 423 Applications which use this media type: Script interpreters as 424 discussed in [this document]. 426 Additional information: 428 Magic number(s): n/a 430 File extension(s): .js, .mjs 431 Macintosh File Type Code(s): TEXT 433 Person & email address to contact for further information: See 434 Author's Address section of [this document]. 436 Intended usage: COMMON 438 Restrictions on usage: The .mjs file extension signals that the file 439 represents a JavaScript module. Execution environments that rely 440 on file extensions to determine how to process inputs parse .mjs 441 files using the Module grammar of [ECMA-262]. 443 Author: See Author's Address section of [this document]. 445 Change controller: IESG 447 6.2. Historic Javascript Media Types 449 The following media types are added or updated for historical 450 purposes. All herein have an intended usage of OBSOLETE, and are not 451 expected to be in use with modern implementations. 453 6.2.1. application/ecmascript 455 Type name: application 457 Subtype name: ecmascript 459 Required parameters: N/A 461 Optional parameters: charset, see section 4.1 of [this document]. 463 Encoding considerations: Binary 465 Security considerations: See section 5 of [this document].. 467 Interoperability considerations: See various sections of [this 468 document]. 470 Published specification: [this document] 472 Applications which use this media type: Script interpreters as 473 discussed in [this document]. 475 Additional information: 477 Magic number(s): n/a 478 File extension(s): .es, .mjs 480 Macintosh File Type Code(s): TEXT 482 Person & email address to contact for further information: See 483 Author's Address section of [this document]. 485 Intended usage: OBSOLETE 487 Restrictions on usage: This media type is obsolete; current 488 implementations should use text/javascript as the only JavaScript/ 489 ECMAScript media type. The .mjs file extension signals that the 490 file represents a JavaScript module. Execution environments that 491 rely on file extensions to determine how to process inputs parse 492 .mjs files using the Module grammar of [ECMA-262]. 494 Author: See Author's Address section of [this document]. 496 Change controller: IESG 498 6.2.2. application/javascript 500 Type name: application 502 Subtype name: javascript 504 Required parameters: N/A 506 Optional parameters: charset, see section 4.1 of [this document]. 508 Encoding considerations: Binary 510 Security considerations: See section 5 of [this document].. 512 Interoperability considerations: charset, see section 4.1 of [this 513 document]. 515 Published specification: [this document] 517 Applications which use this media type: Script interpreters as 518 discussed in [this document]. 520 Additional information: 522 Magic number(s): n/a 524 File extension(s): .js, .mjs 525 Macintosh File Type Code(s): TEXT 527 Person & email address to contact for further information: See 528 Author's Address section of [this document]. 530 Intended usage: OBSOLETE 532 Restrictions on usage: This media type is obsolete; current 533 implementations should use text/javascript as the only JavaScript/ 534 ECMAScript media type. The .mjs file extension signals that the 535 file represents a JavaScript module. Execution environments that 536 rely on file extensions to determine how to process inputs parse 537 .mjs files using the Module grammar of [ECMA-262]. 539 Author: See Author's Address section of [this document]. 541 Change controller: IESG . 543 6.2.3. application/x-ecmascript 545 Type name: application 547 Subtype name: x-ecmascript 549 Required parameters: N/A 551 Optional parameters: : charset, see section 4.1 of [this document]. 553 Encoding considerations: Binary 555 Security considerations: See section 5 of [this document].. 557 Interoperability considerations: See various sections of [this 558 document]. 560 Published specification: [this document] 562 Applications which use this media type: Script interpreters as 563 discussed in [this document]. 565 Additional information: 567 Magic number(s): n/a 569 File extension(s): .es, .mjs 571 Macintosh File Type Code(s): TEXT 573 Person & email address to contact for further information: See 574 Author's Address section of [this document]. 576 Intended usage: OBSOLETE 578 Restrictions on usage: This media type is obsolete; current 579 implementations should use text/javascript as the only JavaScript/ 580 ECMAScript media type. The .mjs file extension signals that the 581 file represents a JavaScript module. Execution environments that 582 rely on file extensions to determine how to process inputs parse 583 .mjs files using the Module grammar of [ECMA-262]. 585 Author: See Author's Address section of [this document]. 587 Change controller: IESG 589 6.2.4. application/x-javascript 591 Type name: application 593 Subtype name: x-javascript 595 Required parameters: N/A 597 Optional parameters: : charset, see section 4.1 of [this document]. 599 Encoding considerations: Binary 601 Security considerations: See section 5 of [this document].. 603 Interoperability considerations: See various sections of [this 604 document]. 606 Published specification: [this document] 608 Applications which use this media type: Script interpreters as 609 discussed in [this document]. 611 Additional information: 613 Magic number(s): n/a 615 File extension(s): .js, .mjs 617 Macintosh File Type Code(s): TEXT 619 Person & email address to contact for further information: See 620 Author's Address section of [this document]. 622 Intended usage: OBSOLETE 624 Restrictions on usage: This media type is obsolete; current 625 implementations should use text/javascript as the only JavaScript/ 626 ECMAScript media type. The .mjs file extension signals that the 627 file represents a JavaScript module. Execution environments that 628 rely on file extensions to determine how to process inputs parse 629 .mjs files using the Module grammar of [ECMA-262]. 631 Author: See Author's Address section of [this document]. 633 Change controller: IESG 635 6.2.5. text/ecmascript 637 Type name: text 639 Subtype name: ecmascript 641 Required parameters: N/A 643 Optional parameters: : charset, see section 4.1 of [this document]. 645 Encoding considerations: Binary 647 Security considerations: See section 5 of [this document].. 649 Interoperability considerations: See various sections of [this 650 document]. 652 Published specification: [this document] 654 Applications which use this media type: Script interpreters as 655 discussed in [this document]. 657 Additional information: 659 Magic number(s): n/a 661 File extension(s): .es, .mjs 663 Macintosh File Type Code(s): TEXT 665 Person & email address to contact for further information: See 666 Author's Address section of [this document]. 668 Intended usage: OBSOLETE 669 Restrictions on usage: This media type is obsolete; current 670 implementations should use text/javascript as the only JavaScript/ 671 ECMAScript media type. The .mjs file extension signals that the 672 file represents a JavaScript module. Execution environments that 673 rely on file extensions to determine how to process inputs parse 674 .mjs files using the Module grammar of [ECMA-262]. 676 Author: See Author's Address section of [this document]. 678 Change controller: IESG 680 6.2.6. text/javascript1.0 682 Type name: text 684 Subtype name: javascript1.0 686 Required parameters: N/A 688 Optional parameters: : charset, see section 4.1 of [this document]. 690 Encoding considerations: Binary 692 Security considerations: See section 5 of [this document].. 694 Interoperability considerations: See various sections of [this 695 document]. 697 Published specification: [this document] 699 Applications which use this media type: Script interpreters as 700 discussed in [this document]. 702 Additional information: 704 Magic number(s): n/a 706 File extension(s): .js, .mjs 708 Macintosh File Type Code(s): TEXT 710 Person & email address to contact for further information: See 711 Author's Address section of [this document]. 713 Intended usage: OBSOLETE 715 Restrictions on usage: This media type is obsolete; current 716 implementations should use text/javascript as the only JavaScript/ 717 ECMAScript media type. The .mjs file extension signals that the 718 file represents a JavaScript module. Execution environments that 719 rely on file extensions to determine how to process inputs parse 720 .mjs files using the Module grammar of [ECMA-262]. 722 Author: See Author's Address section of [this document]. 724 Change controller: IESG 726 6.2.7. text/javascript1.1 728 Type name: text 730 Subtype name: javascript1.1 732 Required parameters: N/A 734 Optional parameters: : charset, see section 4.1 of [this document]. 736 Encoding considerations: Binary 738 Security considerations: See section 5 of [this document].. 740 Interoperability considerations: See various sections of [this 741 document]. 743 Published specification: [this document] 745 Applications which use this media type: Script interpreters as 746 discussed in [this document]. 748 Additional information: 750 Magic number(s): n/a 752 File extension(s): .js, .mjs 754 Macintosh File Type Code(s): TEXT 756 Person & email address to contact for further information: See 757 Author's Address section of [this document]. 759 Intended usage: OBSOLETE 761 Restrictions on usage: This media type is obsolete; current 762 implementations should use text/javascript as the only JavaScript/ 763 ECMAScript media type. The .mjs file extension signals that the 764 file represents a JavaScript module. Execution environments that 765 rely on file extensions to determine how to process inputs parse 766 .mjs files using the Module grammar of [ECMA-262]. 768 Author: See Author's Address section of [this document]. 770 Change controller: IESG 772 6.2.8. text/javascript1.2 774 Type name: text 776 Subtype name: javascript1.2 778 Required parameters: N/A 780 Optional parameters: : charset, see section 4.1 of [this document]. 782 Encoding considerations: Binary 784 Security considerations: See section 5 of [this document].. 786 Interoperability considerations: See various sections of [this 787 document]. 789 Published specification: [this document] 791 Applications which use this media type: Script interpreters as 792 discussed in [this document]. 794 Additional information: 796 Magic number(s): n/a 798 File extension(s): .js, .mjs 800 Macintosh File Type Code(s): TEXT 802 Person & email address to contact for further information: See 803 Author's Address section of [this document]. 805 Intended usage: OBSOLETE 807 Restrictions on usage: This media type is obsolete; current 808 implementations should use text/javascript as the only JavaScript/ 809 ECMAScript media type. The .mjs file extension signals that the 810 file represents a JavaScript module. Execution environments that 811 rely on file extensions to determine how to process inputs parse 812 .mjs files using the Module grammar of [ECMA-262]. 814 Author: See Author's Address section of [this document]. 816 Change controller: IESG 818 6.2.9. text/javascript1.3 820 Type name: text 822 Subtype name: javascript1.3 824 Required parameters: N/A 826 Optional parameters: : charset, see section 4.1 of [this document]. 828 Encoding considerations: Binary 830 Security considerations: See section 5 of [this document].. 832 Interoperability considerations: See various sections of [this 833 document]. 835 Published specification: [this document] 837 Applications which use this media type: Script interpreters as 838 discussed in [this document]. 840 Additional information: 842 Magic number(s): n/a 844 File extension(s): .js, .mjs 846 Macintosh File Type Code(s): TEXT 848 Person & email address to contact for further information: See 849 Author's Address section of [this document]. 851 Intended usage: OBSOLETE 853 Restrictions on usage: This media type is obsolete; current 854 implementations should use text/javascript as the only JavaScript/ 855 ECMAScript media type. The .mjs file extension signals that the 856 file represents a JavaScript module. Execution environments that 857 rely on file extensions to determine how to process inputs parse 858 .mjs files using the Module grammar of [ECMA-262]. 860 Author: See Author's Address section of [this document]. 862 Change controller: IESG 864 6.2.10. text/javascript1.4 866 Type name: text 868 Subtype name: javascript1.4 870 Required parameters: N/A 872 Optional parameters: : charset, see section 4.1 of [this document]. 874 Encoding considerations: Binary 876 Security considerations: See section 5 of [this document].. 878 Interoperability considerations: See various sections of [this 879 document]. 881 Published specification: [this document] 883 Applications which use this media type: Script interpreters as 884 discussed in [this document]. 886 Additional information: 888 Magic number(s): n/a 890 File extension(s): .js, .mjs 892 Macintosh File Type Code(s): TEXT 894 Person & email address to contact for further information: See 895 Author's Address section of [this document]. 897 Intended usage: OBSOLETE 899 Restrictions on usage: This media type is obsolete; current 900 implementations should use text/javascript as the only JavaScript/ 901 ECMAScript media type. The .mjs file extension signals that the 902 file represents a JavaScript module. Execution environments that 903 rely on file extensions to determine how to process inputs parse 904 .mjs files using the Module grammar of [ECMA-262]. 906 Author: See Author's Address section of [this document]. 908 Change controller: IESG 910 6.2.11. text/javascript1.5 912 Type name: text 914 Subtype name: javascript1.5 916 Required parameters: N/A 918 Optional parameters: : charset, see section 4.1 of [this document]. 920 Encoding considerations: Binary 922 Security considerations: See section 5 of [this document].. 924 Interoperability considerations: See various sections of [this 925 document]. 927 Published specification: [this document] 929 Applications which use this media type: Script interpreters as 930 discussed in [this document]. 932 Additional information: 934 Magic number(s): n/a 936 File extension(s): .js, .mjs 938 Macintosh File Type Code(s): TEXT 940 Person & email address to contact for further information: See 941 Author's Address section of [this document]. 943 Intended usage: OBSOLETE 945 Restrictions on usage: This media type is obsolete; current 946 implementations should use text/javascript as the only JavaScript/ 947 ECMAScript media type. The .mjs file extension signals that the 948 file represents a JavaScript module. Execution environments that 949 rely on file extensions to determine how to process inputs parse 950 .mjs files using the Module grammar of [ECMA-262]. 952 Author: See Author's Address section of [this document]. 954 Change controller: IESG 956 6.2.12. text/jscript 958 Type name: text 960 Subtype name: jscript 962 Required parameters: N/A 964 Optional parameters: : charset, see section 4.1 of [this document]. 966 Encoding considerations: Binary 968 Security considerations: See section 5 of [this document].. 970 Interoperability considerations: See various sections of [this 971 document]. 973 Published specification: [this document] 975 Applications which use this media type: Script interpreters as 976 discussed in [this document]. 978 Additional information: 980 Magic number(s): n/a 982 File extension(s): .js, .mjs 984 Macintosh File Type Code(s): TEXT 986 Person & email address to contact for further information: See 987 Author's Address section of [this document]. 989 Intended usage: OBSOLETE 991 Restrictions on usage: The .mjs file extension signals that the file 992 represents a JavaScript module. Execution environments that rely 993 on file extensions to determine how to process inputs parse .mjs 994 files using the Module grammar of [ECMA-262]. 996 Author: See Author's Address section of [this document]. 998 Change controller: IESG 1000 6.2.13. text/livescript 1002 Type name: text 1004 Subtype name: livescript 1006 Required parameters: N/A 1008 Optional parameters: : charset, see section 4.1 of [this document]. 1010 Encoding considerations: Binary 1012 Security considerations: See section 5 of [this document].. 1014 Interoperability considerations: See various sections of [this 1015 document]. 1017 Published specification: [this document] 1019 Applications which use this media type: Script interpreters as 1020 discussed in [this document]. 1022 Additional information: 1024 Magic number(s): n/a 1026 File extension(s): .js, .mjs 1028 Macintosh File Type Code(s): TEXT 1030 Person & email address to contact for further information: See 1031 Author's Address section of [this document]. 1033 Intended usage: OBSOLETE 1035 Restrictions on usage: The .mjs file extension signals that the file 1036 represents a JavaScript module. Execution environments that rely 1037 on file extensions to determine how to process inputs parse .mjs 1038 files using the Module grammar of [ECMA-262]. 1040 Author: See Author's Address section of [this document]. 1042 Change controller: IESG 1044 6.2.14. text/x-ecmascript 1046 Type name: text 1048 Subtype name: x-ecmascript 1050 Required parameters: N/A 1052 Optional parameters: : charset, see section 4.1 of [this document]. 1054 Encoding considerations: Binary 1056 Security considerations: See section 5 of [this document].. 1058 Interoperability considerations: See various sections of [this 1059 document]. 1061 Published specification: [this document] 1063 Applications which use this media type: Script interpreters as 1064 discussed in [this document]. 1066 Additional information: 1068 Magic number(s): n/a 1070 File extension(s): .es, .mjs 1072 Macintosh File Type Code(s): TEXT 1074 Person & email address to contact for further information: See 1075 Author's Address section of [this document]. 1077 Intended usage: OBSOLETE 1079 Restrictions on usage: The .mjs file extension signals that the file 1080 represents a JavaScript module. Execution environments that rely 1081 on file extensions to determine how to process inputs parse .mjs 1082 files using the Module grammar of [ECMA-262]. 1084 Author: See Author's Address section of [this document]. 1086 Change controller: IESG 1088 6.2.15. text/x-javascript 1090 Type name: text 1092 Subtype name: x-javascript 1094 Required parameters: N/A 1096 Optional parameters: : charset, see section 4.1 of [this document]. 1098 Encoding considerations: Binary 1100 Security considerations: See section 5 of [this document].. 1102 Interoperability considerations: See various sections of [this 1103 document]. 1105 Published specification: [this document] 1107 Applications which use this media type: Script interpreters as 1108 discussed in [this document]. 1110 Additional information: 1112 Magic number(s): n/a 1114 File extension(s): .js, .mjs 1116 Macintosh File Type Code(s): TEXT 1118 Person & email address to contact for further information: See 1119 Author's Address section of [this document]. 1121 Intended usage: OBSOLETE 1123 Restrictions on usage: The .mjs file extension signals that the file 1124 represents a JavaScript module. Execution environments that rely 1125 on file extensions to determine how to process inputs parse .mjs 1126 files using the Module grammar of [ECMA-262]. 1128 Author: See Author's Address section of [this document]. 1130 Change controller: IESG 1132 7. References 1134 7.1. Normative References 1136 [CHARSETS] 1137 IANA, "Assigned character sets", n.d., 1138 . 1140 [ECMA-262] 1141 Ecma International, "Standard ECMA-262: ECMAScript 1142 Language Specification", June 2019, . 1145 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1146 Requirement Levels", BCP 14, RFC 2119, 1147 DOI 10.17487/RFC2119, March 1997, 1148 . 1150 [RFC2397] Masinter, L., "The "data" URL scheme", RFC 2397, 1151 DOI 10.17487/RFC2397, August 1998, 1152 . 1154 [RFC2978] Freed, N. and J. Postel, "IANA Charset Registration 1155 Procedures", BCP 19, RFC 2978, DOI 10.17487/RFC2978, 1156 October 2000, . 1158 [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC 1159 Text on Security Considerations", BCP 72, RFC 3552, 1160 DOI 10.17487/RFC3552, July 2003, 1161 . 1163 [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 1164 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 1165 2003, . 1167 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform 1168 Resource Identifier (URI): Generic Syntax", STD 66, 1169 RFC 3986, DOI 10.17487/RFC3986, January 2005, 1170 . 1172 [RFC3987] Duerst, M. and M. Suignard, "Internationalized Resource 1173 Identifiers (IRIs)", RFC 3987, DOI 10.17487/RFC3987, 1174 January 2005, . 1176 [RFC4329] Hoehrmann, B., "Scripting Media Types", RFC 4329, 1177 DOI 10.17487/RFC4329, April 2006, 1178 . 1180 [RFC6265] Barth, A., "HTTP State Management Mechanism", RFC 6265, 1181 DOI 10.17487/RFC6265, April 2011, 1182 . 1184 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 1185 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 1186 May 2017, . 1188 7.2. Informative References 1190 [HTML] WHATWG, "HTML Living Standard", August 2017, 1191 . 1194 [RFC3236] Baker, M. and P. Stark, "The 'application/xhtml+xml' Media 1195 Type", RFC 3236, DOI 10.17487/RFC3236, January 2002, 1196 . 1198 [RFC3875] Robinson, D. and K. Coar, "The Common Gateway Interface 1199 (CGI) Version 1.1", RFC 3875, DOI 10.17487/RFC3875, 1200 October 2004, . 1202 [SPECTRE] Kocher, P., Fogh, A., Gerkin, D., Gruss, D., Haas, W., 1203 Hamburg, M., Lipp, M., Mangard, S., Prescher, T., Schwarz, 1204 M., and Y. Yarom, "Spectre Attacks: Exploiting Speculative 1205 Execution", January 2018, 1206 . 1208 [TC39-MIME-ISSUE] 1209 TC39, "Add `application/javascript+module` mime to remove 1210 ambiguity", August 2017, . 1213 Appendix A. Acknowledgements 1215 This work builds upon its antecedent document, authored by Bjoern 1216 Hoehrmann. The authors would like to thank Adam Roach, Anne van 1217 Kesteren, Allen Wirfs-Brock, Alexey Melnikov, James Snell, Mark 1218 Nottingham, Murray Kucherawy, and Suresh Krishnan for their guidance 1219 and feedback throughout this process. 1221 Appendix B. Changes from RFC 4329 1223 o Added a section discussing ECMAscript modules and the impact on 1224 processing. 1226 o Updated the Security Considerations to discuss concerns associated 1227 with ECMAscript modules and SharedArrayBuffers. 1229 o Updated the character encoding scheme detection to remove 1230 normative guidance on its use, to better reflect operational 1231 reality. 1233 o Changed the intended usage of the media type text/javascript from 1234 obsolete to common. 1236 o Changed the intended usage for all other script media types to 1237 obsolete. 1239 o Updated various references where the original has been osboleted 1241 o Updated references to ECMA-262 to match the version at time of 1242 publication. 1244 Authors' Addresses 1246 Matthew A. Miller 1248 Email: linuxwolf+ietf@outer-planes.net 1250 Myles Borins 1251 GitHub 1253 Email: mylesborins@github.com 1255 Mathias Bynens 1256 Google 1258 Email: mths@google.com 1260 Bradley Farias 1262 Email: bradley.meck@gmail.com