0

Take this code:

let jsonRequest = new XMLHttpRequest();
jsonRequest.overrideMimeType("application/json");
jsonRequest.open('GET', './js/settings.json', true);

IE doesn't support overrideMimeType, and my HTML has been set to UTF-8. Is there a risk to leaving the overrideMimeType line out? It seems to work fine without it. This question has pretty much the same issue, but the answer isn't really clear.

Community
  • 1
  • 1
Paul Redmond
  • 3,276
  • 4
  • 32
  • 52

1 Answers1

0

IE started supporting this mime-type overriding from their v11. But this is never necessary in practice, which is discussed on the other post you've linked.

From the security point, that you are concerned about - the answer is NO. Not using this can't impose any security issue, similarly using this alone won't make you better secure.

If you're concerned about response validity, say for example - if it's valid json before parsing and using, there is a better choice of using getResponseHeader method, which will also facilitate you aborting the request in case of invalid header very early as soon as the headers arrived; see https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/getResponseHeader

Arif
  • 308
  • 2
  • 8