NGINX如何忽略MIME类型，JS文件中的PHP变量

Question

I have a PHP script that is called as a JavaScript file in order to render some server-side variables inside of the script, ie,:

<script src="script.js.php?var1=x&var2=y"></script>

This technique works fine with Apache, but with NGINX the browser won't load the script because of strict MIME checking. I get this error in Safari:

Refused to execute https://mydomain/script.js.php?var1=x&var2=y as script because "X-Content-Type: nosniff" was given and its Content-Type is not a script MIME type.

The PHP is not rendering in the JS file even though the script gives: header("Content-type: text/javascript; charset: UTF-8"); It seems to render a CSS file just fine using this same technique.

I do not see add_header X-Content-Type-Options nosniff; added anywhere in NGINX config (maybe I'm not finding the right file).

Is there a way to disable this MIME checking feature entirely for a site? Thanks!

Answer 1

This seems like a terrible way to do things. It doesn't make your code very portable nor easily maintained by someone else. You're better off using an ajax call and sending your variables as post or get that way. It's a little more work but definitely makes for better code.

Also, this of course means you don't need to make any web server changes to make this work.

BTW - This is jQuery AJAX, adjust to usage as you see fit. jQuery isn't required, this is just easier to stub out.

<script>
  var var1 = '<?php echo $var1; ?>';
  var var2 = '<?php echo $var2; ?>';
  var dataStream = { 'var1' : var1, 'var2' : var2 }; 
  $.ajax({
        method: "POST",
        url: "some.php",
        data: dataStream,
        dataType: 'json',

        }
</script>