-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Description
What is the issue with the HTML Standard?
Step 1 of https://html.spec.whatwg.org/multipage/links.html#link-type-stylesheet says "If the resource's Content-Type metadata is not text/css, then set success to false.". That seems pretty straightforward.
However, https://html.spec.whatwg.org/multipage/links.html#link-type-stylesheet also says The default type for resources given by the [stylesheet](https://html.spec.whatwg.org/multipage/links.html#link-type-stylesheet) keyword is [text/css](https://html.spec.whatwg.org/multipage/indices.html#text/css)..
Meanwhile, https://html.spec.whatwg.org/multipage/semantics.html#processing-the-type-attribute says:
If the type attribute is present, then the user agent must assume that the resource is of the given type (even if that is not a valid MIME type string, e.g. the empty string). If the attribute is omitted, but the external resource link type has a default type defined, then the user agent must assume that the resource is of that type.
User agents must not consider the type attribute authoritative — upon fetching the resource, user agents must not use the type attribute to determine its actual type. Only the actual type (as defined in the next paragraph) is used to determine whether to apply the resource, not the aforementioned assumed type.
If the external resource link type defines rules for processing the resource's Content-Type metadata, then those rules apply.
...
If there is no type metadata, but the external resource link type has a default type defined, then the user agent must assume that the resource is of that type.
In the case where there is <link rel="stylesheet" href="foo.css"> and foo.css does not contain a Content-Type header, this text appears to be contradictory: we have explicit rules for processing the Content-Type metadata (that does not exist), but we should also assume that the resource has the default type, but it's also not authoritative.
Meanwhile, Firefox and Chrome will fetch and process that stylesheet without a Content-Type without blinking an eye.
There's too much spooky action at a distance in this part of the specification for my liking; the default type is never referenced outside of the the quoted text, and reading https://html.spec.whatwg.org/multipage/links.html#link-type-stylesheet:process-the-linked-resource on its own gives no indication that anything besides MIME sniffing should be taken into account.