The Linux Page

Apache misconfiguration: AddType versus AddEncoding

I've been using Drupal for a while and only now started to notice a problem with the cache of JavaScript code. In general, I don't cache the JS since they are not dynamic files. But we do that with Snap!.

The Apache mime module offers two options: AddType and AddEncoding

Both options are used in a similar way meaning that both react on file extensions. When a match is found, the corresponding MIME type or content encoding is attached to the content being sent.

If you install the MIME module, it will attempt encode data properly for the most general case, but not all cases. That is, it does not expect JavaScript to be compressed.

The default, somehow, would not make use of the AddEncoding option, however, it uses the AddType to declare that files with the .gz extension should be stamped with MIME type application/x-gzip. This means the contents of the file is not known by the browser when it receives it and thus it doesn't want to interpret it as JavaScript even if it is and the file extension clearly labels the file as such. That's probably viewed as a security feature, although frankly executing data that's supposed to be JavaScript code when it really is something else will fail quickly with no security issue.

AddType x-gzip .gz .tgz

This is neat, but it is wrong. You actually want the AddEncoding instruction:

AddEncoding x-gzip .gz .tgz

The AddType should already include a .js entry, if not, you may add it too:

AddType application/javascript .js

The truth is that the default is to use the system1 MIME type. So you should not need to have the AddType entry.

The fix for me was to make sure the AddEncoding was defined and the AddType was commented out. It resolved my problem with the Drupal Boost module.

Note that the Boost additions that you are supposed to put in your .htaccess file (or corresponding main declaration for your website) sets the type with the T=... entry as shown here:

RewriteRule .* cache/perm/%{SERVER_NAME}%{REQUEST_URI}_\.js\.gz \
                                     [L,QSA,T=text/javascript,E=no-gzip:1]

This rule sends the compressed version of the JavaScript file telling the browser that it is of type text/javascript (which generally works better than application/javascript that older Internet Explorers did not understand.)

  • 1. Apache2 uses its MIME type to determine the AddType content when not explicitly entered in the configuration file.

Pingback

[...] Zobacz resztę artykułu: Apache misconfiguration: AddType versus AddEncoding | The Linux Page [...]