Enable strict MIME type checking for worker scripts

Policy ID
StrictMimetypeCheckForWorkerScriptsEnabled
Scope
Computer Configuration, User Configuration
Supported on
Microsoft Edge version 150, Windows 7 or later
Source
Microsoft Edge Policy Templates (version 155.0.4283.45)
Category
Microsoft Edge

Description

This policy controls whether strict MIME type checking is used for worker scripts.

If you enable or don't configure this policy, worker scripts use strict MIME type checking for JavaScript. Worker scripts that use legacy MIME types are rejected.

If you disable this policy, worker scripts use lax MIME type checking. This allows worker scripts that use legacy MIME types, such as text/ascii, to continue to load and run.

Browsers traditionally used lax MIME type checking, which allowed JavaScript resources to load with several legacy MIME types. This behavior can create security risks by allowing resources to load as scripts when they weren't intended to be used that way.

Microsoft Edge uses strict MIME type checking by default. Enabling this policy follows the default behavior. Disabling this policy lets admins temporarily retain the legacy behavior for compatibility.

For more information about JavaScript and ECMAScript media types, see https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguage.

Registry

ComputerHKEY_LOCAL_MACHINE
  • StrictMimetypeCheckForWorkerScriptsEnabledREG_DWORD
UserHKEY_CURRENT_USER
  • StrictMimetypeCheckForWorkerScriptsEnabledREG_DWORD

Other policies in the same category

View all policies in this category (438)