Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #2854817 by Liam Morland, longwave, alexpott, JoshaHubbers, effulgentsia, alex-b, Mile23, thalles, mr.baileys, Wim Leers, xjm: Duplicate X-Content-Type-Options headers both with the value nosniff

merge-requests/3144/head
xjm 2023-01-26 06:37:33 -06:00
parent e505dc7d76
commit e7b87b5c20
No known key found for this signature in database
GPG Key ID: 206B0B8743BDF4C2
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.htaccess
View File

@ -173,7 +173,13 @@ AddEncoding gzip svgz
# Various header fixes. # Various header fixes.
<IfModule mod_headers.c> <IfModule mod_headers.c>
# Disable content sniffing, since it's an attack vector. # Disable content sniffing for all responses, since it's an attack vector.
# This header is also set in FinishResponseSubscriber, which depending on
# Apache configuration might get placed in the 'onsuccess' table. To prevent
# header duplication, unset that one prior to setting in the 'always' table.
# See "To circumvent this limitation..." in
# https://httpd.apache.org/docs/current/mod/mod_headers.html.
Header onsuccess unset X-Content-Type-Options
Header always set X-Content-Type-Options nosniff Header always set X-Content-Type-Options nosniff
# Disable Proxy header, since it's an attack vector. # Disable Proxy header, since it's an attack vector.
RequestHeader unset Proxy RequestHeader unset Proxy

8
core/assets/scaffold/files/htaccess
View File

@ -173,7 +173,13 @@ AddEncoding gzip svgz
# Various header fixes. # Various header fixes.
<IfModule mod_headers.c> <IfModule mod_headers.c>
# Disable content sniffing, since it's an attack vector. # Disable content sniffing for all responses, since it's an attack vector.
# This header is also set in FinishResponseSubscriber, which depending on
# Apache configuration might get placed in the 'onsuccess' table. To prevent
# header duplication, unset that one prior to setting in the 'always' table.
# See "To circumvent this limitation..." in
# https://httpd.apache.org/docs/current/mod/mod_headers.html.
Header onsuccess unset X-Content-Type-Options
Header always set X-Content-Type-Options nosniff Header always set X-Content-Type-Options nosniff
# Disable Proxy header, since it's an attack vector. # Disable Proxy header, since it's an attack vector.
RequestHeader unset Proxy RequestHeader unset Proxy