[RESOLVED] mime types recognized by IE8

johanafm

Does anyone know where to find a list of mime types supported by IE8? Or have I taken a serious hit to the head recently? Consider

<?php 
header('content-type: text/plain');
echo 'This is just text';
exit;
?>

Expected result: The text shows up in your browser window.
IE8 result: Dialogue with "open", "save", "cancel" buttons 🙁

Why do I care?
Well, I ran into a problem with ajax file upload through transparent XHR emulation by use of dynamically created iframe, courtesy of YUI. The code was written pre release of IE8, and now I realized that it does not work with IE8. So, after an upgrade from YUI 2.7 to 3.0 (since it could have been the reason for my issue), the problem remains and I discovered the above fact. text/plain is not recognized by IE8.

One solution would of course be to set the header as text/html, but what I really am sending is a json-encoded response object. I don't want to have it interpreted as html. Also, wouldn't I have to actually wrap the response in doctype, html and body tags? Or could I forgo any markup without unexpected consequences in browser X?

application/json? Same result as with text/plain, except it also fails in FF 3.5.

Any suggestions on acceptable solutions to the problem would be welcome.

bradgrafelman

I was able to overcome this issue by the following:

header('Content-Type: text/plain');
header('X-Content-Type-Options: nosniff');

Apparently, MIME sniffing is another one of those Micro$oft "features" you get to deal with. 🙂

johanafm wrote:
application/json

According to RFC 4627, "application/json" is indeed the correct MIME type. Relevant snippet from that document:

6. IANA Considerations

The MIME media type for JSON text is application/json.

Type name: application

Subtype name: json

Required parameters: n/a

Optional parameters: n/a

Note, however, that using "application/json" in my test script on IE8 did indeed pop up the file download dialog.

johanafm

Thanks. I had no idea there was an x-content-type-options mime header. Still, proprietary headers or not, is it so much to ask that they manage to implement text/plain as a MIME type. It's not exactly a recent addition. And for a browser released last year to not support application/json...

They seem to be doing some seriously screwed up things (again) at MS. MIME sniffing data sent for an <img src=""> for example. Seriously, if you get an image/subtype, either the data matches said image type, or you shouldn't display it. What reason could there ever be to inform the user that the data appears to be an excel document or whatever, and poses a security risk if displayed as such content. Guessing what to do certainly seems dangerous; discarding the data seems not.

The next time I get a prescription from my doctor, go to the pharamcy to pick it up, come home only to find out it's not the drug I expected, I'll just have a best guess as how to get it into my body, such as possibly grinding it to powder, mixing it with gasoline, injecting it into my bloodstream and hope for the best. But of course, only after showing myself a post-it warning note informing me that this may be hazardous and/or not do what was expected in the first place.
It seems the only reasonable course of action is to lobby for the addition of an "x-prescription-options: dosniff" line to all future prescriptions.
/End MS rant

bradgrafelman

johnafm wrote:
Still, proprietary headers or not, is it so much to ask that they manage to implement text/plain as a MIME type.

Well, it is supported... but apparently the new MSIE has re-ordered the chain of determining the MIME type. I would personally think that if the server supplies a Content-Type header, then you should just accept it and stop. Perhaps for security considerations, however, M$ decided to allow IE to "sniff" out the MIME type based on the file name instead.

You're right, though; MSIE has never been one to follow cross-browser web standards and/or exhibit logical behavior all the time IMHO. Even though every browser has its own quirks, it sure seems like MSIE is in it's own proprietary world that is light years away from other browsers.