Standardize "nosniff" about fetch

[annevk]

I think we should just leave it and not add complexity. And in the future avoid inventing X--stuff altogether. E.g. HTML has application/x-www-form-urlencoded and it's doing just fine for close to two decades now.

[btoews]

👏

[wanderview]

I wrote a gecko bug to implement this for fetch:

https://bugzilla.mozilla.org/show_bug.cgi?id=1150897

Our older general "nosniff" bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=471020

[igrigorik]

@annevk https://tools.ietf.org/html/rfc6648 ... can we drop the X-? /cc @mnot

[annevk]

@igrigorik that would break existing content.

[igrigorik]

Hmm, I guess a broader question then.. For places where we use X-, how do we migrate away from them? Should we add a clause indicating that UA's should look for optionally X- prefixed headers? i.e. X-Thing == Thing?

[mnot]

Yep, that RFC is for new things, not existing things. If you need to make a breaking change on one of those headers, that's your opportunity to change the name, but don't do it just to change the name; that's a worse outcome.