JavaScript MIME Type

What does text/javascript mean?

text/javascript is the current media type for JavaScript and ECMAScript source code. Use it in an HTTP Content-Type header when a server sends a JavaScript resource. The IANA registration lists .js and .mjs, allows an optional charset parameter, and defines no magic number.¹

That lack of a signature is normal for source code. The same opening bytes could be valid JavaScript, another programming language, or plain text. A filename, response header, or other context supplies the type.

Why is text/javascript preferred now?

The web standardized the name only after a long period of competing spellings. RFC 4329 tried to favor application/javascript in 2006, but browsers and servers continued to use text/javascript widely. RFC 9239 reversed that guidance in 2022 to match real deployment. It made text/javascript the sole common JavaScript media type and classified the others as obsolete aliases.³

Browsers retain several old names for compatibility, so an older page may still work. Compatibility is not a reason to copy the old configuration. Using the registered common type makes the server's intent clear and avoids depending on legacy behavior.

How JavaScript became standardized

JavaScript first appeared in Netscape Navigator, and Microsoft later shipped the related JScript implementation. Ecma International began standardization work in November 1996. The first edition of ECMA-262 was adopted in June 1997 under the name ECMAScript.⁴

The language and its media type are related but distinct. ECMA-262 specifies the language. IANA and RFC 9239 specify how JavaScript source is labeled for interchange. New editions of ECMA-262 continue to evolve the language, while the same text/javascript media type applies across editions.¹³

Is .mjs different from .js?

Both extensions are registered for text/javascript, but they can tell a host how to parse the source:

RFC 9239 says .mjs signals the Module grammar in environments that use file extensions for this decision. The media type alone cannot distinguish a classic Script from a Module. In HTML, type="module" supplies that information instead.²³

Changing .js to .mjs is therefore not a content conversion. It can change how a runtime interprets imports, exports, strict-mode behavior, and top-level declarations. Check the target runtime before renaming files.

How to serve and open JavaScript

JavaScript source can be opened in any text editor, although a code editor provides syntax highlighting and diagnostics. A compatible runtime such as a browser or Node.js can execute it.

For an external web resource, a typical response includes:

Content-Type: text/javascript; charset=utf-8
X-Content-Type-Options: nosniff

UTF-8 is the interoperable choice. RFC 9239 requires implementations to support it, and module source must use UTF-8. Classic Script source may declare another supported encoding with charset, but other encodings are discouraged.³

The type="text/javascript" attribute is unnecessary on an ordinary HTML <script> element because JavaScript is the default. This does not make the HTTP response header irrelevant. External modules in particular are subject to strict MIME checking.²

Support in Poly

Poly recognizes .js filenames and files explicitly labeled text/javascript. You can:

• Read the source in a code editor with JavaScript syntax highlighting, word wrap, and in-file search.
• Find identifiers, comments, and other source text with exact search.
• Find relevant code by meaning with semantic search.
• Ask the Poly agent to explain, summarize, or reason about the readable source.

Poly treats the file as source for inspection. It does not run the program, install packages, follow imports automatically, or use execution as proof that the code is safe.

The registered .mjs extension has one practical limitation: Poly does not currently classify that suffix specifically as text/javascript. A valid text file can still receive the normal text workflow, and supplying the registered MIME type preserves the more precise label.

Security and privacy considerations

JavaScript is executable code, and its permissions come from the host environment. A browser script may interact with a page and request network resources. A server-side script may receive filesystem, process, or credential access. RFC 9239 warns against executing untrusted scripts without protection and calls out resource exhaustion, code injection, imported code, and information disclosure as relevant risks.³

Before running an unfamiliar file:

• Read its imports and network destinations.
• Look for dynamic evaluation such as eval() and generated code.
• Review the permissions and secrets available to the runtime.
• Inspect dependency declarations and lockfiles, not only the entry file.
• Test untrusted code only in an appropriately isolated environment.

X-Content-Type-Options: nosniff is also useful for web delivery. It tells a browser not to reinterpret an unsuitable response type as a script, helping the server's declared content policy hold.⁵

Converting or migrating JavaScript files

Most MIME migrations need no source conversion. Replace an obsolete server mapping such as application/javascript with text/javascript, keep the source bytes, and verify the response header in browser developer tools.

Changing language syntax is a different task. Transpiling newer JavaScript for an older runtime, bundling modules, or converting TypeScript to JavaScript can produce new source, but the resulting JavaScript should still be served as text/javascript.

After changing a deployment:

1. Confirm the resource returns Content-Type: text/javascript.
2. Test both direct and dynamically imported modules.
3. Check the browser console for blocked MIME types or missing imports.
4. Keep nosniff enabled and correct the server mapping rather than relying on content guessing.