Intermittent issue in Safari: Refused to execute htmx script due to "X-Content-Type-Options: nosniff"

[axzilla]

Description:

I'm developing apps with Go and HTMX, and I primarily use Safari as my main browser. Unfortunately, Safari intermittently refuses to load the HTMX script with the following error:

Refused to execute https://unpkg.com/[email protected] as script because "X-Content-Type-Options: nosniff" was given and its Content-Type is not a script MIME type.

This issue does not always occur and it works perfectly fine in Chrome and Firefox.

I'm uncertain whether this is a bug in HTMX or an error on my part.

Steps to Reproduce:

1. Use Safari as the browser.
2. Include the HTMX script in the HTML file like this:

   <script src="https://unpkg.com/[email protected]"></script>

3. Open the HTML file in Safari.
4. Observe the console for the error message.

Expected Behavior:

The HTMX script should load without issues, similar to how it functions in Chrome and Firefox.

Actual Behavior:

Safari intermittently refuses to execute the script, displaying the error message related to the "X-Content-Type-Options: nosniff" header.

Additional Information:

• Safari Version: Version 17.4.1 (19618.1.15.11.14)
• macOS Version: 14.4.1 (23E224)
• HTMX Version: 2.0.0
• Go Version: go1.22.4 darwin/arm64

Please let me know if any additional information is needed. Thank you for your help in resolving this issue.

[Telroshan]

I wonder if it's the unpkg auto redirection that messes up here, could you try loading directly with the resolved URL (the one you eventually get when opening the link in your browser directly), aka

<script src="https://unpkg.com/[email protected]/dist/htmx.min.js"></script>

?
Just to see if it works correctly with the script's actual URL or not

[axzilla]

I wonder if it's the unpkg auto redirection that messes up here, could you try loading directly with the resolved URL (the one you eventually get when opening the link in your browser directly), aka

<script src="https://unpkg.com/[email protected]/dist/htmx.min.js"></script>

? Just to see if it works correctly with the script's actual URL or not

Yep this works fine, thanks for that!