# resources.GetRemote: failed to resolve media type (application/javascript)

**URL:** <https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607>\
**Category:** support\
**Created:** [February 19, 2025, 7:50pm UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607 "2025-02-19T19:50:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![deining](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/deining/32/13944_2.png) [@deining](https://discourse.gohugo.io/u/deining)\
**Post date:** [February 19, 2025, 7:50pm UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607/1 "2025-02-19T19:50:48Z")

</div>

This works fine for me:

```auto
{{ $url := "https://cdn.jsdelivr.net/npm/katex@0.16.21/dist/katex.min.js" }}
{{ with try (resources.GetRemote $url) }}
  {{ with .Err }}
    {{ errorf "%s" . }}
  {{ end }}
{{ end }}

```

This does not:

```auto
{{ $url := "https://cdn.jsdelivr.net/npm/@docsearch/js@3" }}
{{ with try (resources.GetRemote $url) }}
  {{ with .Err }}
    {{ errorf "%s" . }}
  {{ end }}
{{ end }}

```

Here an error is thrown:

```auto
ERROR template: shortcodes/test.html:4:22: executing "shortcodes/test.html" at <resources.GetRemote>:
error calling GetRemote: failed to resolve media type for remote resource "https://cdn.jsdelivr.net/npm/@docsearch/js@3"

```

The media type for both files is exactly the same:

```auto
curl -s -I https://cdn.jsdelivr.net/npm/katex@0.16.21/dist/katex.min.js https://cdn.jsdelivr.net/npm/@docsearch/js@3 | grep content-type:
content-type: application/javascript; charset=utf-8
content-type: application/javascript; charset=utf-8

```

I worked around this by adding `application/javascript` to `security.http.mediaTypes` in my `hugo.yml`. Out of interest: what’s the difference that makes the one script load without problems  
and the other fail?

---

<div class="post-metadata">

**Author:** ![jmooring](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jmooring/32/4214_2.png) [@jmooring](https://discourse.gohugo.io/u/jmooring)\
**Post date:** [February 19, 2025, 9:41pm UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607/2 "2025-02-19T21:41:54Z")

</div>

#### What Hugo does

Hugo’s [`resources.GetRemote`](https://gohugo.io/functions/resources/getremote/) function safeguards against malicious payloads by carefully handling remote resource requests. Here’s how it works:

1. Filename determination: The filename is extracted from the `Content-Disposition` header (if present), or from the URL path.

2. Content type retrieval: The `Content-Type` header from the response is used.

3. Extension hints: Hugo attempts to determine the file extension to help identify the media type:

4. Media type resolution: Hugo uses a combination of [built-in media types](https://gohugo.io/templates/output-formats/#media-types), the `extensionHints`, and the resource’s content to determine the correct media type. If the media type cannot be resolved, an error is thrown: `failed to resolve media type for remote resource`.

5. Success: If a media type is successfully determined, the request is considered successful, and the resource content is available via the [`Content`](https://gohugo.io/methods/resource/content/) method.

#### The problem

Your first request succeeds because, despite the `Content-Type` (`application/javascript`) not being a built-in Hugo type, the filename has a `.js` extension. This provides an `extensionHint`, allowing Hugo to associate it with a known media type.

Your second request fails because the filename lacks an extension. Since the `Content-Type` is not a built-in type, and there are no `extensionHints`, Hugo cannot determine the media type, resulting in the error.

### The solution

To resolve this, you need to tell Hugo how to handle `application/javascript` by adding it to your site configuration:

```plaintext
[mediaTypes."application/javascript"]
suffixes = ["js"]

```

This configuration tells Hugo that files with the `application/javascript` content type should be treated as JavaScript files (using the `.js` suffix). This provides the necessary information for Hugo to successfully process the second request.

#### Notes

The explanation above omits some details. See [source code](https://github.com/gohugoio/hugo/blob/c3d435acfae17c8619451337e4f09348b05a32fa/resources/resource_factories/create/remote.go#L243-L291).

Hugo excludes `application/javascript` from its built-in media types because that media type is obsolete per [RFC 9239](https://datatracker.ietf.org/doc/html/rfc9239#section-6). The correct media type is `text/javascript`, which is one of Hugo’s built-in media types. Also see the [IANA registry](https://www.iana.org/assignments/media-types/media-types.xhtml).

---

<div class="post-metadata">

**Author:** ![deining](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/deining/32/13944_2.png) [@deining](https://discourse.gohugo.io/u/deining)\
**Post date:** [February 20, 2025, 10:28am UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607/3 "2025-02-20T10:28:09Z")

</div>

[quote=“jmooring, post:2, topic:53607”]

### The solution

To resolve this, you need to tell Hugo how to handle `application/javascript` by adding it to your site configuration:

```auto
[mediaTypes."application/javascript"]
suffixes = ["js"]

```

This works great, thanks @jmooring for pointing that out!

---

<div class="post-metadata">

**Author:** ![deining](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/deining/32/13944_2.png) [@deining](https://discourse.gohugo.io/u/deining)\
**Post date:** [February 20, 2025, 10:37am UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607/4 "2025-02-20T10:37:11Z")

</div>

**Remark (mostly for the records!?):**

After reading the section [Security policy](https://gohugo.io/about/security/#security-policy) from the official docs, I tried to resolve my problem by adding this to my `hugo.yaml`:

```auto
security:
  http:
    mediaTypes:
    - ^application/javascript$

```

This didn’t work however.

Only after adding the lines below, the media type could be resolved:

```auto
security:
  http:
    mediaTypes:
    - ^application/javascript; charset=utf-8$

```

This is a bit counter-intuitive IMHO.

---

<div class="post-metadata">

**Author:** ![davidsneighbour](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/davidsneighbour/32/24507_2.png) [@davidsneighbour](https://discourse.gohugo.io/u/davidsneighbour)\
**Post date:** [February 20, 2025, 10:59am UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607/5 "2025-02-20T10:59:19Z")

</div>

> This is a bit counter-intuitive IMHO.

Nah, I don’t think so. It’s a regular expression. Every character has a meaning.

```auto
security:
  http:
    mediaTypes:
    - ^application/javascript$

```

The `^` means “the start of the string” and `$` means “the end of the string”, so `^something$` means “`something` (the string), and only that, exactly that, nothing more”.

`^application/javascript` would have probably worked.

---

<div class="post-metadata">

**Author:** ![system](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/system/32/1_2.png) [@system](https://discourse.gohugo.io/u/system)\
**Post date:** [February 22, 2025, 10:59am UTC](https://discourse.gohugo.io/t/resources-getremote-failed-to-resolve-media-type-application-javascript/53607/6 "2025-02-22T10:59:35Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.