72

I want to add source maps to my site, but I'd like to exercise some control over how they're served. What is an appropriate MIME type to use for them?

Some data

  • The content itself is JavaScript, but not meant to be executed as such.
  • CDN.js serves http://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.2/jquery.min.map with Content-Type: application/octet-stream.
  • Google serves http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.map with Content-Type: application/json
  • The Source Maps spec states that maps should begin with )]} to prevent them from being evaluated as actual JavaScript (and thus exposing cross-site scripting attacks). That makes the file invalid JSON and valid, but un-runnable JavaScript.
borisdiakur
  • 10,387
  • 7
  • 68
  • 100
James A. Rosen
  • 64,193
  • 61
  • 179
  • 261
  • 1
    I don't know that there's a standard yet. My gut would say to use something like `application/x-source-map`. – zzzzBov Nov 11 '13 at 17:16

1 Answers1

91

application/json is the best mimetype for sourcemap files.

application/octet-stream might work well with browser devtools, however this mimetype is a signal to browsers to initiate a download. This may cause problems for tools like performance analysis tooling or JS exception tracking that attempt to make sense of the source maps.

Paul Irish
  • 47,354
  • 22
  • 98
  • 132
  • 3
    OK. I was actually hoping for something more specific so I could write an nginx rule that would lock down access by MIME type. I guess I can match on path and make sure all source maps end in `.js.map`. – James A. Rosen Nov 11 '13 at 18:27
  • 2
    @JamesA.Rosen this is what I did in Nginx: `types { application/json map; }`. Just update your mime types configuration and the extension is `.map`. – Paul Redmond Apr 27 '16 at 17:34