JavaScript MIME type: text/javascript

The MIME type for JavaScript, in both .js and .mjs files, is text/javascript. RFC 9239 (2022) made it the only current name and marked the rest obsolete: application/javascript, application/x-javascript, application/ecmascript, text/ecmascript, text/jscript, text/livescript and the versioned text/javascript1.0 to 1.5. It reverses RFC 4329, which in 2006 had steered everyone toward application/javascript; the industry kept using text/javascript, and HTML defaults to it. RFC 9239 also added .mjs as the extension for code parsed as a module. Search any of the retired names in the tool below and it resolves to text/javascript, whose card lists all 14.

text/javascript   JavaScript (ECMAScript)
.js .mjs
Content-Type: text/javascript; charset=utf-8

charset

The only parameter is charset, and it only applies to classic scripts. RFC 9239 requires module sources to be UTF-8 and decodes them as UTF-8 whatever the header says. For a classic script, a byte order mark beats the header, and the header beats the default.

What browsers check

• Module scripts are strict. A <script type="module">, a static or dynamic import, and a module worker run only if the response has a JavaScript MIME type. The obsolete names still pass: the MIME Sniffing standard lists 16 JavaScript MIME types, application/javascript and application/x-javascript among them. What fails is text/plain, text/html, application/octet-stream or no type at all.
• The usual text/html is a single-page app’s fallback. A request for a chunk that no longer exists, such as /assets/index-3f2a.js after a deploy, gets index.html with a 200, and the browser refuses it with a strict MIME type error.
• Classic scripts. A plain <script src> runs under most wrong types, but never under image/*, audio/*, video/* or text/csv. With X-Content-Type-Options: nosniff, it needs a JavaScript MIME type too.

Servers that still say application/javascript

nginx’s stock mime.types maps js to application/javascript and has no mjs line, so a .mjs file falls through to default_type, which the shipped nginx.conf sets to application/octet-stream, and the module doesn’t load. Express 4’s express.static serves both extensions as application/javascript; charset=UTF-8; Express 5 sends text/javascript; charset=utf-8. Python’s built-in mimetypes table switched to text/javascript in 3.12. Only the missing mjs breaks anything.

In your stack

# In the http block, after include mime.types. The later line wins,
# with a "duplicate extension" warning for js.
types {
    text/javascript  js mjs;
}

Apache’s bundled mime.types already maps both to text/javascript; on an older one:

AddType text/javascript .js .mjs

// Express 4: correct what express.static picks
app.use(express.static('dist', {
  setHeaders(res, path) {
    if (/\.m?js$/.test(path)) res.setHeader('Content-Type', 'text/javascript; charset=utf-8');
  },
}));

aws s3 sync dist s3://my-bucket --exclude '*' --include '*.js' --include '*.mjs' \
  --content-type 'text/javascript; charset=utf-8'

import mimetypes
mimetypes.add_type("text/javascript", ".js")    # Python 3.11 and older
mimetypes.add_type("text/javascript", ".mjs")