1. 17 IANA 注意事项
    1. 17.1 text/html
    2. 17.2 multipart/x-mixed-replace
    3. 17.3 application/xhtml+xml
    4. 17.4 text/cache-manifest
    5. 17.5 text/ping
    6. 17.6 application/microdata+json
    7. 17.7 text/event-stream
    8. 17.8 `Cross-Origin-Embedder-Policy`
    9. 17.9 `Cross-Origin-Embedder-Policy-Report-Only`
    10. 17.10 `Cross-Origin-Opener-Policy`
    11. 17.11 `Origin-Isolation`
    12. 17.12 `Ping-From`
    13. 17.13 `Ping-To`
    14. 17.14 `Refresh`
    15. 17.15 `Last-Event-ID`
    16. 17.16 `X-Frame-Options`
    17. 17.17 web+ scheme prefix

17 IANA 注意事项

17.1 text/html

This registration is for community review and will be submitted to the IESG for review, approval, and registration with IANA.

Type name:
text
Subtype name:
html
Required parameters:
No required parameters
Optional parameters:
charset

The charset parameter may be provided to specify the document's character encoding, overriding any character encoding declarations in the document other than a Byte Order Mark (BOM). The parameter's value must be one of the labels of the character encoding used to serialize the file. [ENCODING]

Encoding considerations:
8bit (see the section on character encoding declarations)
Security considerations:

Entire novels have been written about the security considerations that apply to HTML documents. Many are listed in this document, to which the reader is referred for more details. Some general concerns bear mentioning here, however:

HTML is scripted language, and has a large number of APIs (some of which are described in this document). Script can expose the user to potential risks of information leakage, credential leakage, cross-site scripting attacks, cross-site request forgeries, and a host of other problems. While the designs in this specification are intended to be safe if implemented correctly, a full implementation is a massive undertaking and, as with any software, user agents are likely to have security bugs.

Even without scripting, there are specific features in HTML which, for historical reasons, are required for broad compatibility with legacy content but that expose the user to unfortunate security problems. In particular, the img element can be used in conjunction with some other features as a way to effect a port scan from the user's location on the Internet. This can expose local network topologies that the attacker would otherwise not be able to determine.

HTML relies on a compartmentalization scheme sometimes known as the same-origin policy. An origin in most cases consists of all the pages served from the same host, on the same port, using the same protocol.

It is critical, therefore, to ensure that any untrusted content that forms part of a site be hosted on a different origin than any sensitive content on that site. Untrusted content can easily spoof any other page on the same origin, read data from that origin, cause scripts in that origin to execute, submit forms to and from that origin even if they are protected from cross-site request forgery attacks by unique tokens, and make use of any third-party resources exposed to or rights granted to that origin.

Interoperability considerations:
Rules for processing both conforming and non-conforming content are defined in this specification.
Published specification:
This document is the relevant specification. Labeling a resource with the text/html type asserts that the resource is an HTML document using the HTML syntax.
Applications that use this media type:
Web browsers, tools for processing Web content, HTML authoring tools, search engines, validators.
Additional information:
Magic number(s):
No sequence of bytes can uniquely identify an HTML document. More information on detecting HTML documents is available in the WHATWG MIME Sniffing standard. [MIMESNIFF]
File extension(s):
"html" and "htm" are commonly, but certainly not exclusively, used as the extension for HTML documents.
Macintosh file type code(s):
TEXT
Person & email address to contact for further information:
Ian Hickson <ian@hixie.ch>
Intended usage:
Common
Restrictions on usage:
No restrictions apply.
Author:
Ian Hickson <ian@hixie.ch>
Change controller:
W3C

Fragments used with text/html resources either refer to the indicated part of the document or provide state information for in-page scripts.

17.2 multipart/x-mixed-replace

这个注册用于社区评审，之后会提交给 IESG 评审通过，通过 IANA 注册。

类型名：
multipart
子类型名：
x-mixed-replace
必选参数：
可选参数：
无
编码注意事项：
binary
安全注意事项：
multipart/x-mixed-replace 的子资源可能是任意类型，包括 有明显的安全性问题的资源，比如 text/html。
可互操作性注意事项：
无
已发布规范：
本规范描述了 Web 浏览器的处理规则。 产生这一类型资源的一致性要求同 multipart/mixed。 [RFC2046]
使用该媒体类型的应用：
这个类型用于由 Web 服务器产生的资源，由 Web 浏览器读取。
更多信息：
神奇数字：
不存在可以标识 multipart/x-mixed-replace 资源的字节序列。
文件扩展名：
该类型没有特定的文件扩展名。
Mac 文件类型码：
该类型没有推荐的 Mac 文件类型码。
更多信息请联系的人和电子邮件地址：
Ian Hickson <ian@hixie.ch>
用途：
通用
使用限制：
没有限制。
作者：
Ian Hickson <ian@hixie.ch>
变更控制：
W3C

与 multipart/x-mixed-replace 资源一起使用的 Fragments 的语义： 每个 body 部分适用那个 body 部分使用的类型的定义。

17.3 application/xhtml+xml

这个注册用于社区评审，之后会提交给 IESG 评审通过，通过 IANA 注册。

类型名：
application
子类型名：
xhtml+xml
必选参数：
同 application/xml [RFC7303]
可选参数：
同 application/xml [RFC7303]
编码注意事项：
同 application/xml [RFC7303]
安全注意事项：
同 application/xml [RFC7303]
可互操作性注意事项：
同 application/xml [RFC7303]
已发布规范：
将资源标记为 application/xhtml+xml 类型断言了 该资源是一个 XML 文档，且可能有一个 HTML 命名空间 的 文档元素。 因此，相关标准是 XML 规范，XML 规范中的 Namespaces，以及本规范。 [XML] [XMLNS]
使用该媒体类型的应用：
同 application/xml [RFC7303]
更多信息：
神奇数字：
同 application/xml [RFC7303]
文件扩展名：
有一个 HTML 命名空间 的 文档元素 的 XML 资源 有时候用 "xhtml" 和 "xht" 扩展名。
Mac 文件类型码：
TEXT
更多信息请联系的人和电子邮件地址：
Ian Hickson <ian@hixie.ch>
用途：
通用
使用限制：
没有限制。
作者：
Ian Hickson <ian@hixie.ch>
变更控制：
W3C

与 application/xhtml+xml 资源一起使用的 Fragments 的语义同 XML MIME type。 [RFC7303]

17.4 text/cache-manifest

这个注册用于社区评审，之后会提交给 IESG 评审通过，通过 IANA 注册。

类型名：
text
子类型名：
cache-manifest
必选参数：
无
可选参数：
charset

可以提供 charset 参数。 该参数的值必须是 "utf-8"。 该参数没有意义；只是为了与遗留服务器兼容。

编码注意事项：
8bit (总是 UTF-8)
安全注意事项：

Cache 清单自己不会直接引起风险，除非其中包含了敏感信息。 但是要求实现方基于缓存清单填充缓存时遵循特定的规则， 来确保遵守了那些基于域的限制。 没有正确地实现这些规则可能导致信息泄露，跨站脚本攻击，以及类似的事情。

可互操作性注意事项：
无论是符合规范的内容还是不合规范的内容，处理规则都定义在本规范中。
已发布规范：
本文档就是相关规范。
使用该媒体类型的应用：
Web 浏览器。
更多信息：
神奇数字：
Cache 清单以字符串 "CACHE MANIFEST" 开始， 紧接着一个 U+0020 SPACE 字符，一个 U+0009 CHARACTER TABULATION (tab) 字符， 一个 U+000A LINE FEED (LF) 字符，或一个 U+000D CARRIAGE RETURN (CR) 字符。
文件扩展名：
"appcache"
Mac 文件类型码：
该类型没有推荐的 Mac 文件类型码。
更多信息请联系的人和电子邮件地址：
Ian Hickson <ian@hixie.ch>
用途：
通用
使用限制：
没有限制。
作者：
Ian Hickson <ian@hixie.ch>
变更控制：
W3C

Fragments 对 text/cache-manifest 资源没有语义。

17.5 text/ping

This registration is for community review and will be submitted to the IESG for review, approval, and registration with IANA.

Type name:
text
Subtype name:
ping
Required parameters:
No parameters
Optional parameters:
charset

The charset parameter may be provided. The parameter's value must be "utf-8". This parameter serves no purpose; it is only allowed for compatibility with legacy servers.

Encoding considerations:
Not applicable.
Security considerations:

If used exclusively in the fashion described in the context of hyperlink auditing, this type introduces no new security concerns.

Interoperability considerations:
Rules applicable to this type are defined in this specification.
Published specification:
This document is the relevant specification.
Applications that use this media type:
Web browsers.
Additional information:
Magic number(s):
text/ping resources always consist of the four bytes 0x50 0x49 0x4E 0x47 (`PING`).
File extension(s):
No specific file extension is recommended for this type.
Macintosh file type code(s):
No specific Macintosh file type codes are recommended for this type.
Person & email address to contact for further information:
Ian Hickson <ian@hixie.ch>
Intended usage:
Common
Restrictions on usage:
Only intended for use with HTTP POST requests generated as part of a web browser's processing of the ping attribute.
Author:
Ian Hickson <ian@hixie.ch>
Change controller:
W3C

Fragments have no meaning with text/ping resources.

17.6 application/microdata+json

这个注册用于社区评审，之后会提交给 IESG 评审通过，通过 IANA 注册。

类型名：
application
子类型名：
microdata+json
必选参数：
同 application/json [JSON]
可选参数：
同 application/json [JSON]
编码注意事项：
8bit (总是 UTF-8)
安全注意事项：
同 application/json [JSON]
可互操作性注意事项：
同 application/json [JSON]
已发布规范：
将资源标记为 application/microdata+json 类型断言了 该资源是一个 JSON 文本，包含一个只有一个 "items" 属性的对象，这个属性由一个数组组成，每个都是一个对象。 该对象有一个 "id" 属性，其值为字符串； 有一个 "type" 属性，其值为字符串； 有一个 "properties" 属性，其属性值为对象或字符串构成的数组， 其中的对象与上述 "items" 属性的格式一致。 因此，相关规范是 JSON 规范和本规范。 [JSON]
使用该媒体类型的应用：

传输用于 HTML 的元数据特性的数据的那些应用。尤其是用于拖放操作的那类应用。

更多信息：
神奇数字：
同 application/json [JSON]
文件扩展名：
同 application/json [JSON]
Mac 文件类型码：
同 application/json [JSON]
更多信息请联系的人和电子邮件地址：
Ian Hickson <ian@hixie.ch>
用途：
通用
使用限制：
没有限制。
作者：
Ian Hickson <ian@hixie.ch>
变更控制：
W3C

与 application/microdata+json 资源一起使用的 Fragments 的语义同 application/json（也就是说写这篇文档时还没有额外的语义）。 [JSON]

17.7 text/event-stream

This registration is for community review and will be submitted to the IESG for review, approval, and registration with IANA.

Type name:
text
Subtype name:
event-stream
Required parameters:
No parameters
Optional parameters:
charset

The charset parameter may be provided. The parameter's value must be "utf-8". This parameter serves no purpose; it is only allowed for compatibility with legacy servers.

Encoding considerations:
8bit (always UTF-8)
Security considerations:

An event stream from an origin distinct from the origin of the content consuming the event stream can result in information leakage. To avoid this, user agents are required to apply CORS semantics. [FETCH]

Event streams can overwhelm a user agent; a user agent is expected to apply suitable restrictions to avoid depleting local resources because of an overabundance of information from an event stream.

Servers can be overwhelmed if a situation develops in which the server is causing clients to reconnect rapidly. Servers should use a 5xx status code to indicate capacity problems, as this will prevent conforming clients from reconnecting automatically.

Interoperability considerations:
Rules for processing both conforming and non-conforming content are defined in this specification.
Published specification:
This document is the relevant specification.
Applications that use this media type:
Web browsers and tools using web services.
Additional information:
Magic number(s):
No sequence of bytes can uniquely identify an event stream.
File extension(s):
No specific file extensions are recommended for this type.
Macintosh file type code(s):
No specific Macintosh file type codes are recommended for this type.
Person & email address to contact for further information:
Ian Hickson <ian@hixie.ch>
Intended usage:
Common
Restrictions on usage:
This format is only expected to be used by dynamic open-ended streams served using HTTP or a similar protocol. Finite resources are not expected to be labeled with this type.
Author:
Ian Hickson <ian@hixie.ch>
Change controller:
W3C

Fragments have no meaning with text/event-stream resources.

17.8 `Cross-Origin-Embedder-Policy`

This section describes a header for registration in the Permanent Message Header Field Registry. [RFC3864]

Header field name:
Cross-Origin-Embedder-Policy
Applicable protocol:
http
Status:
standard
Author/Change controller:
WHATWG
Specification document(s):
This document is the relevant specification.
Related information:
None.

17.9 `Cross-Origin-Embedder-Policy-Report-Only`

This section describes a header for registration in the Permanent Message Header Field Registry. [RFC3864]

Header field name:
Cross-Origin-Embedder-Policy-Report-Only
Applicable protocol:
http
Status:
standard
Author/Change controller:
WHATWG
Specification document(s):
This document is the relevant specification.
Related information:
None.

17.10 `Cross-Origin-Opener-Policy`

This section describes a header for registration in the Permanent Message Header Field Registry. [RFC3864]

Header field name:
Cross-Origin-Opener-Policy
Applicable protocol:
http
Status:
standard
Author/Change controller:
WHATWG
Specification document(s):
This document is the relevant specification.
Related information:
None.

17.11 `Origin-Isolation`

This section describes a header for registration in the Permanent Message Header Field Registry. [RFC3864]

Header field name:
Origin-Isolation
Applicable protocol:
http
Status:
standard
Author/Change controller:
WHATWG
Specification document(s):
This document is the relevant specification.
Related information:
None.

17.12 `Ping-From`

本小节描述了 Permanent Message Header Field Registry 中的一个头部注册项。 [RFC3864]

头部字段名：
Ping-From
适用协议：
http
状态：
标准
作者/变更控制：
W3C
规范文档：
本文档就是相关规范。
相关信息：
无

17.13 `Ping-To`

本小节描述了 Permanent Message Header Field Registry 中的一个头部注册项。 [RFC3864]

头部字段名：
Ping-To
适用协议：
http
状态：
标准
作者/变更控制：
W3C
规范文档：
本文档就是相关规范。
相关信息：
无

17.14 `Refresh`

This section describes a header for registration in the Permanent Message Header Field Registry. [RFC3864]

Header field name:
Refresh
Applicable protocol:
http
Status:
standard
Author/Change controller:
WHATWG
Specification document(s):
This document is the relevant specification.
Related information:
None.

17.15 `Last-Event-ID`

本小节描述了 Permanent Message Header Field Registry 中的一个头部注册项。 [RFC3864]

头部字段名：
Last-Event-ID
适用协议：
http
状态：
标准
作者/变更控制：
W3C
规范文档：
本文档就是相关规范。
相关信息：
无

17.16 `X-Frame-Options`

This section describes a header for registration in the Permanent Message Header Field Registry. [RFC3864]

Header field name:
X-Frame-Options
Applicable protocol:
http
Status:
standard
Author/Change controller:
WHATWG
Specification document(s):
This document is the relevant specification.
Related information:
None.

17.17 web+ scheme prefix

This section describes a convention for use with the IANA URI scheme registry. It does not itself register a specific scheme. [RFC7595]

Scheme name:
Schemes starting with the four characters "web+" followed by one or more letters in the range a-z.
Status:
Permanent
Scheme syntax:
Scheme-specific.
Scheme semantics:
Scheme-specific.
Encoding considerations:
All "web+" schemes should use UTF-8 encodings where relevant.
Applications/protocols that use this scheme name:
Scheme-specific.
Interoperability considerations:
The scheme is expected to be used in the context of web applications.
Security considerations:
Any web page is able to register a handler for all "web+" schemes. As such, these schemes must not be used for features intended to be core platform features (e.g. network transfer protocols like HTTP or FTP). Similarly, such schemes must not store confidential information in their URLs, such as usernames, passwords, personal information, or confidential project names.
Contact:
Ian Hickson <ian@hixie.ch>
Change controller:
Ian Hickson <ian@hixie.ch>
References:
Custom scheme handlers, HTML Living Standard: https://html.spec.whatwg.org/#custom-handlers