application/importmap+json MIME Type Registration
draft-bedford-app-importmap-media-reg-00

Abstract

Media type registration for JSON import map definitions that control the behavior of JavaScript imports.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on May 20, 2020.

Copyright Notice

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 1.1. Terminology
• 2. Example
• 3. Security Considerations
• 4. IANA Considerations
• 4.1. The application/importmap+json Media Type
• 5. Acknowledgements
• 6. Normative References
• Author's Address

1. Introduction

This memo defines a media type Section 4.1 for application/importmap+json.

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

2. Example

          {
            "imports": {
              "pkg": "/lib/pkg/main.js"
            }
          }
        

          <script type="importmap" src="/application.importmap"></script>
          <script type="module">
            // loads /lib/pkg/main.js
            import pkg from 'pkg';
          </script>
        

An example application.importmap, following the import maps specification (https://wicg.github.io/import-maps/) can be written:

3. Security Considerations

The following security considerations apply when using application/importmap+json: Control of the import map should be considered to be a form of execution-level application control. This is because import maps have the ability to direct which module resolutions are to be provided for all module import specifiers in a given JavaScript environment, including for example the ability to map arbitrary import specifiers into data: URLs. Integration with existing policy systems, such as CORS and CSP, can be used to mitigate and restrict unwanted target URLs from being executed. The import maps specification states that only those import maps served to browsers with the `application/importmap+json` MIME type will be executed allowing for server-level control of import map deployment to mitigate unintended usage in browsers.

4. IANA Considerations

This document defines a single action for IANA:

4.1. The application/importmap+json Media Type

The application/importmap+json Media Type is defined as follows:

Type name:

application

Subtype name:

importmap+json

Required parameters:

none

Optional parameters:

none

Encoding considerations:

8bit (always UTF-8)

Security considerations:

discussed in Section 3 of [RFCXXXX].

Interoperability considerations:

none

Published specification:

https://wicg.github.io/import-maps/

Applications that use this media type:

This is primarily a browser-specific media type but may also be adopted in other JavaScript environments.

Fragment identifier considerations:

N/A

Additional information:

Deprecated alias names for this type: N/A

Magic number(s): none

File extension(s): .importmap

Macintosh file type code(s): Same as for application/json

Person & email address to contact for further information:

WICG Mailing List <public-wicg@w3.org> or at import maps GitHub repository https://github.com/WICG/import-maps

Intended usage:

COMMON

Restrictions on usage:

No restrictions apply.

Author:

See the Authors' Addresses section of [RFCXXXX]

Change controller:

WHATWG

Provisional registration?

yes

5. Acknowledgements

Thanks to Domenic Denicola for their work in specifying import maps and the browser integration of JavaScript modules.

6. Normative References

Author's Address