4 ms·
I feel like at this point, browsers should at least not prefer text/html if "open image in new tab" or similar is used.
by 998244353 2y ago
I feel like at this point, browsers should at least not prefer text/html if "open image in new tab" or similar is used.
- computerfriend 2y agoOr if the path ends in a known binary file extension.
- account42 2y agoThis won't work if implemented browser-wide as malicious website will just adjust the URLs for their images to compensate. In general, URL file extension snooping only causes more problems than it solves.
- computerfriend 2y agoMaybe. It seems sensible to me that if the UA is requesting a path that ends in .jpg (for instance), they're expecting a JPEG and the UA should accept image/jpeg. At least if this escalates the arms race, user-hostile websites won't commit this specific crime, instead they'll serve content that better matches the URL.