demo · v142

Server Config Doctor

Chrome 142 enforces RFC 6838's MIME-token rules for the *+json suffix. Most servers get this right by accident. A handful of vintage Java/PHP middlewares emit headers with stray spaces in the subtype — those fail. Here's a checker that tells you whether your server's Content-Type would have worked silently before and breaks now.

real-world Content-Type strings, scored

nginx default

application/json
passes

Apollo GraphQL

application/graphql-response+json
passes

OpenAPI 3.0

application/vnd.api+json; charset=utf-8
passes

JSON-LD

application/ld+json
passes

Vintage CMS

application/x ld +json
fails — spaces in subtype

misconfigured proxy

application/json ; charset=UTF 8
fails — space in charset token

Java enterprise

Application/JSON
passes (case-insensitive)

legacy IBM

application/atom (+json)
fails — parens in subtype

test your own Content-Type

—

relevant logic

// Pseudo-code mirroring the MIME Sniffing spec.
function isValidJsonModuleMime(value) {
  const [typeSubtype, ...params] = value.split(";");
  const [type, subtype] = typeSubtype.trim().split("/");
  // RFC 6838: type and subtype tokens contain only HTTP token chars
  // (no spaces, no parens, no other delimiters).
  if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(type.trim())) return false;
  if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(subtype.trim())) return false;
  // Must match *+json suffix or be application/json
  return /^application\/json$/i.test(type + "/" + subtype) ||
         /\+json$/.test(subtype.trim());
}

see also