https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209
--- Comment #1 from Kyle M Hall (khall) <[email protected]> --- Created attachment 202838 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202838&action=edit Bug 43209: Add the X-Content-Type-Options: nosniff response header Koha already sends X-Frame-Options: SAMEORIGIN on its responses but does not send X-Content-Type-Options. Without it a browser may MIME sniff a response and treat it as a content type other than the one declared, which can turn an otherwise harmless response into executable script and enable content type confusion attacks. This adds X-Content-Type-Options: nosniff everywhere Koha already sets X-Frame-Options: in C4::Output::output_with_http_headers and in the two header blocks in C4::Auth ( the login page and get_template_and_user ), so the staff client, the OPAC, and the login page all send it. An old report ( bug 23874 ) suggested nosniff broke the advanced cataloging editor, but that was a mixed content ( http on https ) problem, not nosniff, and it no longer reproduces. The editor's scripts, including the svc/cataloguing/framework JSONP call, are served as text/javascript, so nosniff does not block them. Test Plan: 1) Apply this patch 2) Restart all the things! 3) Run: curl -sI <staff-url>/cgi-bin/koha/mainpage.pl 4) Note the response includes X-Content-Type-Options: nosniff 5) Repeat for the OPAC and for a logged-out staff page ( the login page ) 6) Note all of them include the header! 7) Open the advanced cataloging editor ( Cataloging > Advanced editor ) 8) Note the editor still loads correctly! -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
