Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove duplicated 'charset' in Content-Type header for Javascript files #3306

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

jorti
Copy link

@jorti jorti commented Feb 8, 2025

Javascript files are served over HTTP with an incorrect Content-Type header because the 'charset' option is duplicated:

$ curl -I http://127.0.0.1:8083/static/js/table.js
HTTP/1.1 200 OK
Content-Disposition: inline; filename=table.js
Content-Type: text/javascript; charset=UTF-8; charset=utf-8
Content-Length: 35967
Last-Modified: Sat, 16 Nov 2024 06:21:28 GMT
Cache-Control: no-cache
ETag: "1731738088.0-35967-471731799"
Date: Sat, 08 Feb 2025 16:30:42 GMT
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:; object-src 'none';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

This header is not RFC 1521 compliant and it's breaking some reverse proxy setups that perform compression. See this bug for reference:

crocodilestick/Calibre-Web-Automated#217

Javascript files are served over HTTP with an incorrect Content-Type
header because the 'charset' option is duplicated:

    $ curl -I http://127.0.0.1:8083/static/js/table.js
    HTTP/1.1 200 OK
    Content-Disposition: inline; filename=table.js
    Content-Type: text/javascript; charset=UTF-8; charset=utf-8
    Content-Length: 35967
    Last-Modified: Sat, 16 Nov 2024 06:21:28 GMT
    Cache-Control: no-cache
    ETag: "1731738088.0-35967-471731799"
    Date: Sat, 08 Feb 2025 16:30:42 GMT
    Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:; object-src 'none';
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Strict-Transport-Security: max-age=31536000

This header is not RFC 1521 compliant and it's breaking some reverse
proxy setups that perform compression. See this bug for reference:

crocodilestick/Calibre-Web-Automated#217
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant