text/javascript
textThe current standard MIME type for JavaScript. RFC 9239 (2022) standardizes text/javascript as the definitive type, deprecating application/javascript, application/x-javascript, and text/ecmascript. Browsers require this type for <script src> loading and ES modules. Content-Security-Policy script-src applies to this type.
Details
RFC 9239 (May 2022) consolidated the many JavaScript MIME type variants. The winner: text/javascript.
Historical confusion: text/javascript – original Netscape type, now the standard (RFC 9239) application/javascript – previously used, now deprecated per RFC 9239 application/x-javascript – non-standard, legacy only text/ecmascript – ECMAScript branding, deprecated
ES modules: import statements require the script to be served as text/javascript. Most bundlers (webpack, Vite, esbuild) already handle this correctly.
CSP: Content-Security-Policy script-src controls execution. The MIME type alone does not control execution – the browser also checks CSP.
Server config: map .js and .mjs → text/javascript.
Common use
JavaScript files served to browsers, ES module imports
Security note
Never serve user-supplied content as text/javascript. Even with X-Content-Type-Options: nosniff, always validate server-generated JS.