Friendly TAG Review: content type?

[travisleithead]

In response to w3ctag/design-reviews#195

• Content type: application/reports --- but it looks like json! Is this really necessary? Is it IANA registered--seems like 'no'.

[RByers]

@mikewest, I think this is one for you to dig into?

[mikewest]

1. We intentionally don't want to send application/json, as servers often will accept JSON into otherwise dangerous endpoints. Since the reporter controls the endpoints, it's quite possible to deliver reports to an arbitrary victim. It would be unfortunate if a maliciously crafted error report could trigger CSRF or worse on someone's internal server. So, I don't have strong feelings about the MIME type, except that it really shouldn't be application/json. Do y'all have a distinct preference?

2. We should absolutely poke at IANA. I thought we'd added the MIME type to the document's IANA Considerations section, but apparently we didn't. :(

[patrickkettner]

when @RByers and I spoke yesterday, we agreed with @mikewest's first point. A different mimetype is a requirement. If for some reason the rfc 3864 stuff mentioned in point 2 couldn't/wouldn't be reserved for this, we would just x- to get around the json issues mike mentioned.

Changing assignee to myself to move the IANA discussion forward

[mikewest]

1. Please don't use x- anything. It makes @mnot sad. :)
2. application/reports is what @juliatuttle implemented in Chrome. That seems reasonable to me.
3. You'll need to add an IANA considerations section noting that it's totally your content type, and point folks to it, as discussed in https://tools.ietf.org/html/rfc6838#section-5. (@mnot might also be able to tell you if I've pulled the correct reference; I'm not actually that familiar with the registry)

[patrickkettner]

sounds good to me. Wasn't sure if it was a wrath-of-the-gods or a please-let-us-know sort of situation when using unofficial non x- namespaced stuff.

[mnot]

Happy to help if needed.

[mikewest]

Per @annevk's suggestion in whatwg/fetch#621, it might be reasonable to change the MIME type to application/reports+json to make the format clear. If there are no objections to that, I'll add the IANA considerations section and poke at IETF folks accordingly.

[travisleithead]

application/reports+json seems good--it's not JSON (to help with the problem noted earlier, but does contain that flavor so that folks can understand it as a 'dialect' of JSON.