Enable strict MIME type checking for worker scripts

Policy ID
StrictMimetypeCheckForWorkerScriptsEnabled
Scope
Computer Configuration, User Configuration
Supported on
Microsoft Windows 7 or later
Source
Google Chrome Policy Templates (version 156.0.8078.80)
Category
Google › Google Chrome

Description

This policy enables strict MIME type checking for worker scripts.

When enabled or unset, then worker scripts will use strict MIME type checking for JavaScript, which is the new default behaviour. Worker scripts with legacy MIME types will be rejected.

When disabled, then worker scripts will use lax MIME type checking, so that worker scripts with legacy MIME types, e.g. text/ascii, will continue to be loaded and executed.

Browsers traditionally used lax MIME type checking, so that resources with a number of legacy MIME types were supported. E.g. for JavaScript resources, text/ascii is a legacy supported MIME type. This may cause security issues, by allowing to load resources as scripts that were never intended to be used as such. Chrome will transition to use strict MIME type checking in the near future. The enabled policy will track the default behaviour. Disabling this policy allows administrators to retain the legacy behaviour, if desired.

See https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguage for details about JavaScript / ECMAScript media types.

Registry

ComputerHKEY_LOCAL_MACHINE
  • StrictMimetypeCheckForWorkerScriptsEnabledREG_DWORD
UserHKEY_CURRENT_USER
  • StrictMimetypeCheckForWorkerScriptsEnabledREG_DWORD

Other policies in the same category

View all policies in this category (235)