Refused to execute script because strict MIME type checking is enabled

zabumba

I have setup an NGINX reverse proxy to a web service (www.aaa.com) through another domain name (www.bbb.com) while adding a few additional pages to the latter.

Request come from www.bbb.com (nodejs app) but they need to look like they are coming from www.aaa.com or I will have a CORS (Cross-origin resource sharing) issue. Hence NGINX to tweak the headers.

NGINX config

worker_processes 1;
events {
    worker_connections 1024;
}
http {
    include mime.types;
    include servers/*;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;

    server {
        listen 443 ssl;
        server_name www.bbb.com;
        ssl_certificate /etc/pki/nginx/server.crt;
        ssl_certificate_key /etc/pki/nginx/private/server.key;
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 5m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        location / {
            proxy_set_header X-Real-IP 127.0.0.1;
            proxy_set_header Host www.aaa.com;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_pass https://www.aaa.com;
            proxy_http_version 1.1;
        }
    }
}

Looks like one of the resources doesn't get the correct MIME Type through the reverse proxy https://www.aaa.com/scripts/some.script.api.js

Error

Refused to execute script from 'https://www.bbb.com/scripts/some.script.api.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

text/html is incorrect indeed, I would be expecting application/javascript

1. Why is this happening? I figured that MIME Types are just set automatically? Could that be that www.aaa.com has implement some new CORS security rule?

2. Is there a way to tell NGINX to set the correct MIME Type for that particular file? I have tried a few things to no avail.

e.g.

add_header Content-Type application/javascript;

but I may have used wrong. Any pointers?

Similar issue described on another Stackoverflow question

cnst

You could try using http://nginx.org/r/default_type; another thing that comes to mind would be http://nginx.org/r/proxy_hide_headers.

I would also suggest that the first line of action would be to determine the root cause of this issue — is the incorrect MIME type coming from your upstream? Then look there.

Otherwise, my guess would be that the reason you're getting text/html is because something else is wrong with your configuration, and a 404 Not Found response gets generated for your .js file (or maybe even 403 Forbidden by the upstream, or 500 by nginx), thus resulting in the text/html MIME type.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Refused to execute script from because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled

Refused to execute script from '*' because its MIME type ('application/json') is not executable, and strict MIME type checking is enabled

Refused to execute script, strict MIME type checking is enabled?

Refused to execute script from URL because its MIME type ('application/json') is not executable, and strict MIME type checking is enabled

Refused to execute script from 'file_name.php' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled

Error on minification in console "Refused to execute because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled"

Refused to apply style from '' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled

Refused to apply style because its MIME type "text/html" is not supported stylesheet MIME type, and strict MIME checking is enabled

Refused to apply style from 'URL' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled

Refused to apply style from [Link] because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled

"Refused to apply style from because its MIME type "('font/woff2')" is not a supported stylesheet MIME type, and strict MIME checking is enabled"

(Node Express)Refused to apply style because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled

Refused to apply style from... because its MIME type ('text/html') is not a supported style-sheet MIME type, and strict MIME checking is enabled

Refused to execute script from '..../angular.min.js' because its MIME type ('application/octet_stream') is not executable, and strict MIME type check

MIME type ('application/json') is not executable, and strict MIME type checking is enabled

Webpack dev server throws error - Refused to execute script because its MIME type ('text/html') is not executable

Importing jQuery plugin into Angular 2+ Refused to execute script because its MIME type ('text/html') is not executable

Refused to execute script from '*.ts' because its MIME type ('video/vnd.dlna.mpeg-tts') is not executable

Refused to execute script from 'url' because its MIME type ('image/jpeg') is not executable

Refused to execute *path_to_bundle* as script because "X-Content-Type: nosniff" was given and its Content-Type is not a script MIME type

css files are not loaded because strict MIME checking is enabled when using spring security5

Tensorboard is showing a blank page (Refused to execute script from 'http://localhost:6006/index.js' because its MIME type)

Rewrite requests from loopback to angular2 (Refused to execute script because its MIME type ('text/html') is not executable)

Chrome and Spring security: Refused to execute script from 'http://<server url>/assets/app.js' because its MIME type ('') is not executable

Disable Chrome strict MIME type checking

Refused to display style because MIME type

disable chrome strict MIME type checking on local dev

AJAX error message on Chrome, MIME type checking is enabled

Refused to apply style because its MIME type ('text/html') is not a supported stylesheet MIME type