JavaScript MIME Type

What does application/javascript mean?

application/javascript identifies JavaScript source code. It was registered by the IETF in 2006 with .js as its file extension and no magic number. That last detail matters: JavaScript is source text, so there is no fixed byte sequence that reliably distinguishes it from another text file.¹

The media type is still present in the IANA registry, but it is obsolete. New HTTP responses should use text/javascript instead. RFC 9239 describes application/javascript and the other historical spellings as obsolete aliases, while text/javascript is the sole JavaScript media type in common use.²

Why did the recommended MIME type change?

The history is unusually circular. RFC 4329 registered both application/* and text/* JavaScript types in 2006 and tried to steer implementations toward application/javascript. The web ecosystem continued to use text/javascript widely. RFC 9239 updated the registrations in 2022 to match deployed behavior, made text/javascript the common type, and marked application/javascript obsolete.²

Current HTML processing still recognizes legacy JavaScript MIME types for compatibility. That explains why an older site served as application/javascript may continue to work in Chrome, Edge, Firefox, Opera, or Safari. It does not make the old value future-facing. The HTML Standard tells servers to use text/javascript, and MDN gives the same practical recommendation.³⁴

Is application/javascript a file format?

Not by itself. The media type labels ECMAScript source text; it does not define a separate container or encoding. The language is standardized in ECMA-262, while the media-type rules are maintained through the IANA and IETF registrations.²

The IANA entry for application/javascript lists .js. Modern JavaScript also commonly uses .mjs for modules, but RFC 9239 added .mjs to the current text/javascript registration. The extension gives an execution environment useful out-of-band information: .mjs signals that the source should be parsed with ECMAScript's Module grammar rather than its Script grammar.²

How to open a JavaScript file

JavaScript source is readable text. A code editor such as Visual Studio Code can open .js files, and runtimes such as Node.js can execute compatible programs. A web browser can fetch and execute JavaScript as part of a page, but opening a source URL directly is different from loading it through a <script> element.

For web delivery, configure the HTTP server rather than editing the filename:

Content-Type: text/javascript; charset=utf-8
X-Content-Type-Options: nosniff

The charset parameter is optional. RFC 9239 requires UTF-8 support, and module source must be UTF-8. The nosniff header tells browsers not to guess a script type when the server supplies an unsuitable one, reducing the risk that non-script content is executed as code.²⁵

Support in Poly

Poly treats application/javascript as a text media type. It stores the original source without executing it and provides the same text workflow used for other code files:

• The preview opens in a read-only Monaco code editor with filename-based syntax highlighting, word wrap, and in-file search.
• The indexer extracts full text and creates semantic embeddings from up to the first 1 MiB of the file.
• Full-text search can return matching source ranges, while semantic search can find code by meaning as well as exact wording.
• The Poly agent and poly file read can read the source as text. Reading and reasoning do not run the program.

There is an implementation detail worth knowing. Poly has explicit identifiers for both application/javascript and text/javascript, but a filename ending in .js is inferred as text/javascript. Content already labeled application/javascript still follows the text preview, indexing, and agent-reading paths. Poly does not currently give .mjs its own JavaScript MIME inference rule, although a valid UTF-8 .mjs file can still fall back to generic text handling.

Classic scripts and modules are not distinguished by this MIME type

The bytes alone, and the MIME type alone, cannot tell an engine whether a JavaScript source should use the Script or Module grammar. Environments supply that decision separately. In HTML, type="module" selects a module script. Some filesystem-based runtimes use .mjs for the same purpose.²

Modules differ in behavior, not just syntax. They can import dependencies, use strict mode automatically, and keep top-level declarations out of the global object. Serving a module as application/javascript does not communicate those semantics. Use the host environment's module mechanism and serve the resource with text/javascript.³

Security considerations

JavaScript is executable code. RFC 9239 warns that uncontrolled execution can expose host capabilities, consume excessive CPU or memory, import more code, leak information, or enable injection attacks when untrusted input reaches dynamic evaluation features.²

Treat an unfamiliar .js file as source to inspect, not something to run casually. For web applications:

• Serve scripts with text/javascript and set X-Content-Type-Options: nosniff.
• Apply a restrictive Content Security Policy where practical.
• Avoid passing untrusted strings to eval() or similar dynamic-code APIs.
• Review imported modules and package dependencies as part of the program's trust boundary.

Poly's preview is read-only and does not execute JavaScript. That makes it suitable for inspection and search, but it is not a malware analysis sandbox and does not prove that code is safe.

Should an old site be migrated?

Yes. Replace application/javascript with text/javascript in HTTP server mappings, object-storage metadata, framework response headers, and API responses. You normally do not need to change .js filenames or source code.

After the change, inspect the response in browser developer tools. Confirm that Content-Type is text/javascript, then test both classic and module scripts. Pay particular attention to module imports because browsers enforce MIME rules for module graphs more strictly than many legacy classic-script paths.