浏览代码

HUE-5762 [security] Reverting X-Content-Type-Options default option from False to True

Prakash Ranade 8 年之前
父节点
当前提交
acded61
共有 3 个文件被更改,包括 3 次插入3 次删除
  1. 1 1
      desktop/conf.dist/hue.ini
  2. 1 1
      desktop/conf/pseudo-distributed.ini.tmpl
  3. 1 1
      desktop/core/src/desktop/conf.py

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -88,7 +88,7 @@
   ## ssl_password_script=
   ## ssl_password_script=
 
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_type_nosniff=false
+  ## secure_content_type_nosniff=true
 
 
   # X-Xss-Protection: \"1; mode=block\" This is a HTTP response header feature to force XSS protection.
   # X-Xss-Protection: \"1; mode=block\" This is a HTTP response header feature to force XSS protection.
   ## secure_browser_xss_filter=true
   ## secure_browser_xss_filter=true

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -92,7 +92,7 @@
   ## ssl_password_script=
   ## ssl_password_script=
 
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_type_nosniff=false
+  ## secure_content_type_nosniff=true
 
 
   # X-Xss-Protection: \"1; mode=block\" This is a HTTP response header feature to force XSS protection.
   # X-Xss-Protection: \"1; mode=block\" This is a HTTP response header feature to force XSS protection.
   ## secure_browser_xss_filter=true
   ## secure_browser_xss_filter=true

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -208,7 +208,7 @@ SECURE_CONTENT_TYPE_NOSNIFF = Config(
   key="secure_content_type_nosniff",
   key="secure_content_type_nosniff",
   help=_('X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.'),
   help=_('X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.'),
   type=coerce_bool,
   type=coerce_bool,
-  default=False)
+  default=True)
 
 
 SECURE_BROWSER_XSS_FILTER = Config(
 SECURE_BROWSER_XSS_FILTER = Config(
   key="secure_browser_xss_filter",
   key="secure_browser_xss_filter",