SLIM: Structured Low-bandwidth Information Markup v1.0

1. Introduction

The goal of SLIM is to make essential information load fast and reliably on slow, congested, or intermittent networks. SLIM does this by restricting features that tend to harm resilience or add weight.

1.1 Non-goals

2. Scope

This document targets authors and publishers who want a predictable, lightweight subset of HTML for information delivery. It may be profiled by organizations (e.g., gov/NGO) with additional local rules.

3. Conformance

The key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY are to be interpreted as described in RFC 2119. A SLIM document is an HTML document that satisfies all MUST requirements herein. “Discouraged” items are permitted but SHOULD be avoided unless clearly justified.

4. Requirements (SLIM v1.0)

4.1 Document Identification — MUST

<meta name="slim-profile" content="SLIM v1.0">

4.2 Fetch Model (Single-Request) — MUST

A SLIM document MUST fully render after exactly one successful HTTPS request for the document URL, with no additional application-layer network requests initiated during load (i.e., without subsequent user interaction).

In-scope “additional requests” (prohibited during initial load):

• Any HTTP(S) fetch triggered by markup, CSS, or JS that retrieves additional resources (e.g., link[href], @import, @font-face, img/srcset, video/audio sources, manifest, modulepreload, preload, prefetch, prerender, service workers).

• HTTP redirects (3xx) from the document URL.

• Automatic icon/preview fetches referenced by the document (e.g., <link rel="icon">, apple-touch-icon, Open Graph/Twitter image metadata).

Explicitly allowed:

• <link rel="dns-prefetch">

• <link rel="preconnect">

Out of scope (not counted as additional requests):

• DNS resolution, TLS handshakes, OCSP/CRLite, and other transport- or PKI-level operations.

• User-initiated navigations or submissions after initial render (e.g., clicking a link, submitting a form).

Authoring requirements to satisfy this rule:

• Do not include elements/attributes or CSS that fetch external resources of any kind (other than allowed connection hints).

• Do not include <meta http-equiv="refresh"> or any feature that causes background fetches.

• Ensure the canonical document URL resolves directly (200 OK) without redirects.

• Because SLIM is text-only (§4.9) and disallows external stylesheets/scripts (§4.4, §4.7), no other fetches should occur.

Note (favicon behavior): Some user agents may probe /favicon.ico even without a reference. Authors MUST NOT reference icons in the document. Operators SHOULD configure the origin to return 204 No Content (or 410 Gone) for /favicon.ico to avoid extra bytes.

4.3 Fonts — MUST/SHOULD

4.4 Styling — MUST NOT / MAY

4.5 Font Color — SHOULD

4.6 Transport (TLS) — MUST

4.7 Content Delivery and Compression - MUST

• Preferred algorithms:

  • **Brotli (br)** — SHOULD be used for HTTPS delivery to modern browsers.

  • **Zstandard (zstd)** — SHOULD be used for non-browser delivery contexts or where Brotli is unsupported.

• Fallbacks:

  • **Gzip (gzip)** MAY be used for maximum compatibility where Brotli and Zstandard are not supported.

Rationale: Compression substantially reduces payload size and improves load times in low-bandwidth or austere network conditions, which aligns with SLIM’s core goal of efficiency.

4.8 Accessibility — SHOULD

4.9 Tracking — MUST NOT

4.10 Inputs — MUST

4.11 Media — MUST NOT

Prohibited elements and mechanisms (non-exhaustive):

• HTML elements: <img>, <picture>, <video>, <audio>, <svg>, <canvas>, <object>, <embed>, <iframe>, <track>, <source>, <figure> (when used for media).

• CSS: background-image, content: url(...), mask-image, list-style-image, image-set(), or any property/value that loads images.

• URLs/Data URIs: any data: or network URL whose MIME type begins with image/, audio/, or video/.

• Link/meta icons and previews: <link rel="icon">, <link rel="apple-touch-icon">, manifest icons, and social preview metadata such as og:image, twitter:image.

• Script-created media: creating or injecting any of the above at runtime is prohibited (even though SLIM already disallows such scripting).

Allowed:

• Plain text, including Unicode characters and emoji.

• Preformatted ASCII/Unicode diagrams where all content is textual.

Rationale: This ensures predictable payload size, eliminates tracking beacons delivered via images, and maximizes reliability in austere networks. Any essential information MUST be conveyed in text.

4.12 Framing & Embedding — MUST NOT

SLIM documents MUST NOT embed other browsing contexts.

Prohibited:

• <iframe> elements of any kind (including srcdoc)

• Legacy/embedding elements: <object>, <embed>, <frame>, <frameset>

Rationale: Embedded contexts violate the single-request fetch model (§4.14), create side-channel requests, and expand the attack surface (tracking, clickjacking, mixed policy contexts).

4.13 HTTP Version - SHOULD

When SLIM documents are served over a network, servers SHOULD use a modern HTTP version that improves performance and resilience:

• HTTP/3 — SHOULD be preferred where supported by both server and client.

• HTTP/2 — SHOULD be used as a fallback where HTTP/3 is not available.

• HTTP/1.1 — MAY be used only when HTTP/3 and HTTP/2 are unavailable.

Servers MUST maintain compatibility for clients that do not support newer HTTP versions, but SHOULD prioritize protocols that reduce latency, improve multiplexing, and enhance connection reliability — especially in austere network environments.

Rationale: Using HTTP/3 or HTTP/2 enables better performance through features like multiplexed requests, reduced head-of-line blocking, and improved connection handling, all of which support SLIM’s goal of fast, resilient content delivery.

4.14 File Size — ADVISORY

4.15 Versioning — SHOULD

5. Example SLIM Document

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Example SLIM Page</title>
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="slim-profile" content="SLIM v1.0">
</head>
<body style="font-family: system-ui, -apple-system, Segoe UI, Roboto; color: #222;">
  <h1>Clinic Hours</h1>
  <p>We are open <strong>Mon–Fri, 9–5</strong>. Call <a href="tel:+15125551234">512-555-1234</a>.</p>
</body>
</html>

5.1 Content Security Policy (Recommended)

SLIM authors and operators SHOULD consider deploying a Content Security Policy that enforces SLIM restrictions at the browser level. An example of a maximally restrictive CSP is:

Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; font-src 'none'; img-src 'none'; media-src 'none'; script-src 'none'; object-src 'none'; frame-src 'none'; child-src 'none'; connect-src 'self'

This policy prevents the browser from loading or executing any resource type disallowed by SLIM.

6. Security & Privacy Considerations

SLIM enforces several requirements that enhance security and privacy:

• TLS encryption (MUST): All SLIM documents are delivered over HTTPS, ensuring confidentiality and integrity on the wire.

• Text-only restriction (MUST NOT): Prohibits images, audio, video, and other media (§4.13), eliminating image beacons and reducing covert data channels.

• Single-request fetch model (MUST): Requires exactly one HTTPS request during initial load (§4.14), reducing side-channel and supply-chain risk.

• No tracking scripts (MUST NOT): Disallows analytics beacons and advertising pixels (§4.8).

• No framing/embedding (MUST NOT): Disallows <iframe>, <object>, <embed> (§4.15), reducing clickjacking and cross-origin leakage.

• No third-party fonts (MUST NOT): Reduces passive fingerprinting and removes an injection vector (§4.2).

Browser enforcement via CSP (Recommended): Operators SHOULD deploy a restrictive Content Security Policy to have the browser refuse violations. A baseline CSP is provided in §5.1. CSP cannot block transport-level operations (DNS, TLS) and does not affect connection hints like dns-prefetch; however, connect-src governs which origins may be contacted (including preconnect).

Operational hardening (Recommended): To avoid extra fetches, operators SHOULD:

• Return 204 No Content (or 410 Gone) from /favicon.ico.

• Ensure canonical SLIM URLs resolve directly with 200 OK (no redirects).

7. Change History