Disable the content sniffing algorithm if the server instructs us to do so wi...

Disable the content sniffing algorithm if the server instructs us to do so with the nosniff directive.

For context, see http://blogs.msdn.com/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx

R=deanm,darin


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=6422

[darin (slow to review), 2008-12-05 07:10:46]

LGTM

Do you know of any work underway to standardize this (presumably without the X-
prefix)?

[Dean McNamee, 2008-12-05 07:11:31]

This is great!  LGTM.

http://codereview.chromium.org/12982/diff/1/3
File chrome/test/data/nosniff-test.html.mock-http-headers (right):

http://codereview.chromium.org/12982/diff/1/3#newcode5
Line 5: Expires: Tue, 14 Nov 2006 19:23:58 GMT
Do we need the Date and Expires headers for any reason?

[abarth-chromium, 2008-12-05 07:16:28]

On 2008/12/05 07:10:46, darin wrote:
> Do you know of any work underway to standardize this (presumably
> without the X- prefix)?

It's been brought up on the WHATWG list.  Content sniffing is a bit of a
political issue in those circles.  We'll have to see how Hixie responds.

[abarth-chromium, 2008-12-05 07:16:39]

http://codereview.chromium.org/12982/diff/1/3
File chrome/test/data/nosniff-test.html.mock-http-headers (right):

http://codereview.chromium.org/12982/diff/1/3#newcode5
Line 5: Expires: Tue, 14 Nov 2006 19:23:58 GMT
On 2008/12/05 07:11:31, Dean McNamee wrote:
> Do we need the Date and Expires headers for any reason?

I don't think these matter, but I was being consistent with the other content
sniffing tests.  I can remove them all in a second patch, if you like.