Charset in JSON content-type header causing Chrome CORB warning

[jkytomaki]

It looks like new versions of Chrome are logging Cross-Origin Read Blocking (CORB) warnings into the console in the following situation:

• making a post request to a resource returning JSON
• the response having a X-Content-Type-Options nosniff header
• the content-type header having a value application/json; charset=utf-8

According to this Stack Overflow answer removing the charset=utf-8 from the end of the content-type fixes the warning, so Chrome seems to treat this as an invalid content-type.

There are some old closed issues about express adding charset=utf-8 to the end of the content type header and as far as I could see there is currently no way to remove the charset from the header using express. Is it possible to re-evaluate this?

[dougwilson]

No, we cannot re-evaluate the addition of the charset header unless CVE-2014-6393 is going to be rescinded, unfortunately.

Perhaps there are other options? Would you be able to create a very simple app using Express that reproduces the issue and perhaps I can be another set of eyes to see what we can do?

[pszafer]

Hi,
This CVE-2014-6393 is talking about charset field in HTTP Content-Type headers in 400 level responses not 200 level.
Many other libs is deleting those charset info from 200 / application/json response.
cakephp/cakephp#13156
slimphp/Slim#2629

I cannot imagine other options as nobody else had other idea than remove charset info from 200 responses.

[dougwilson]

The CVE description was not updated correctly back them. It applies to all responses.

Unless you can provide a demonstration so we can reproduce the issue, then there is no way forward in this case.

[jkytomaki]

After some more testing with different response headers and trying to created a demonstration of the issue, the removal of the charset suggested in the SO article doesn't seem to have any effect for me. Removing the X-Content-Type-Options nosniff header from responses to OPTIONS requests does seem to remove the warning. You can ignore this report. Thanks for quick replies.