Network Working Group                                    G. Bedford, Ed.
Internet-Draft                                 Verve Interactive Pty Ltd
Intended status: Informational                         November 17, 2019
Expires: May 20, 2020


           application/importmap+json MIME Type Registration
                draft-bedford-app-importmap-media-reg-00

Abstract

   Media type registration for JSON import map definitions that control
   the behavior of JavaScript imports.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on May 20, 2020.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.






Bedford                   Expires May 20, 2020                  [Page 1]


Internet-Draft    application/importmap+json Media Type    November 2019


Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Example . . . . . . . . . . . . . . . . . . . . . . . . . . .   2
   3.  Security Considerations . . . . . . . . . . . . . . . . . . .   3
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   3
     4.1.  The application/importmap+json Media Type . . . . . . . .   3
   5.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   4
   6.  Normative References  . . . . . . . . . . . . . . . . . . . .   5
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   5

1.  Introduction

   This memo defines a media type Section 4.1 for application/
   importmap+json.

1.1.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP
   14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

2.  Example

   An example application.importmap, following the import maps
   specification (https://wicg.github.io/import-maps/) can be written:

             {
               "imports": {
                 "pkg": "/lib/pkg/main.js"
               }
             }

   This would support the following workflow in browsers:

          <script type="importmap" src="/application.importmap"></script>
          <script type="module">
            // loads /lib/pkg/main.js
            import pkg from 'pkg';
          </script>








Bedford                   Expires May 20, 2020                  [Page 2]


Internet-Draft    application/importmap+json Media Type    November 2019


3.  Security Considerations

   The following security considerations apply when using application/
   importmap+json: Control of the import map should be considered to be
   a form of execution-level application control.  This is because
   import maps have the ability to direct which module resolutions are
   to be provided for all module import specifiers in a given JavaScript
   environment, including for example the ability to map arbitrary
   import specifiers into data: URLs.  Integration with existing policy
   systems, such as CORS and CSP, can be used to mitigate and restrict
   unwanted target URLs from being executed.  The import maps
   specification states that only those import maps served to browsers
   with the `application/importmap+json` MIME type will be executed
   allowing for server-level control of import map deployment to
   mitigate unintended usage in browsers.

4.  IANA Considerations

   This document defines a single action for IANA:

4.1.  The application/importmap+json Media Type

   The application/importmap+json Media Type is defined as follows:


   Type name:          application


   Subtype name:       importmap+json


   Required parameters:  none


   Optional parameters:  none


   Encoding considerations:  8bit (always UTF-8)


   Security considerations:  discussed in Section 3 of [RFCXXXX].

   Interoperability considerations:  none


   Published specification:  https://wicg.github.io/import-maps/





Bedford                   Expires May 20, 2020                  [Page 3]


Internet-Draft    application/importmap+json Media Type    November 2019


   Applications that use this media type:  This is primarily a browser-
                       specific media type but may also be adopted in
                       other JavaScript environments.


   Fragment identifier considerations:  N/A


   Additional information:

                          Deprecated alias names for this type: N/A

                          Magic number(s): none

                          File extension(s): .importmap

                          Macintosh file type code(s): Same as for
                          application/json

   Person & email address to contact for further information:  WICG
                       Mailing List <public-wicg@w3.org> or at import
                       maps GitHub repository https://github.com/WICG/
                       import-maps


   Intended usage:     COMMON


   Restrictions on usage:  No restrictions apply.


   Author:             See the Authors' Addresses section of [RFCXXXX]


   Change controller:  WHATWG


   Provisional registration?  yes


5.  Acknowledgements

   Thanks to Domenic Denicola for their work in specifying import maps
   and the browser integration of JavaScript modules.







Bedford                   Expires May 20, 2020                  [Page 4]


Internet-Draft    application/importmap+json Media Type    November 2019


6.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8259]  Bray, T., Ed., "The JavaScript Object Notation (JSON) Data
              Interchange Format", STD 90, RFC 8259,
              DOI 10.17487/RFC8259, December 2017,
              <https://www.rfc-editor.org/info/rfc8259>.

   [W3C.WD-CSP3]
              Kesteren, A., "Content Security Policy Level 3", World
              Wide Web Consortium CR WD-CSP3, February 2019,
              <https://w3c.github.io/webappsec-csp/>.

   [WHATWG-fetch]
              Kesteren, A., "Fetch Standard - CORS Protocol", WHATWG
              Living Standard WHATWG-fetch, October 2019,
              <https://fetch.spec.whatwg.org/#cors-protocol>.

Author's Address

   Guy Bedford (editor)
   Verve Interactive Pty Ltd
   19 Garfield Road
   Cape Town, Western Cape  7708
   South Africa

   Email: guybedford@gmail.com
















Bedford                   Expires May 20, 2020                  [Page 5]