Browse Source

HUE-5762 [security] Reverting X-Content-Type-Options default option from False to True

Prakash Ranade 8 năm trước cách đây
mục cha
commit
acded61e83

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -88,7 +88,7 @@
   ## ssl_password_script=
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_type_nosniff=false
+  ## secure_content_type_nosniff=true
 
   # X-Xss-Protection: \"1; mode=block\" This is a HTTP response header feature to force XSS protection.
   ## secure_browser_xss_filter=true

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -92,7 +92,7 @@
   ## ssl_password_script=
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_type_nosniff=false
+  ## secure_content_type_nosniff=true
 
   # X-Xss-Protection: \"1; mode=block\" This is a HTTP response header feature to force XSS protection.
   ## secure_browser_xss_filter=true

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -208,7 +208,7 @@ SECURE_CONTENT_TYPE_NOSNIFF = Config(
   key="secure_content_type_nosniff",
   help=_('X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.'),
   type=coerce_bool,
-  default=False)
+  default=True)
 
 SECURE_BROWSER_XSS_FILTER = Config(
   key="secure_browser_xss_filter",