added X-Content-Type-Options: nosniff, fixes #2219

mozilla-services · Mar 31, 2017 · 8d76ab0 · 8d76ab0
1 parent 93c411c
commit 8d76ab0
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/server/src/server.js b/server/src/server.js
@@ -188,6 +188,7 @@ app.use((req, res, next) => {
         "Content-Security-Policy",
         `default-src 'self'; img-src 'self' www.google-analytics.com ${CONTENT_NAME} data:; script-src 'self' www.google-analytics.com 'nonce-${uuid}'; style-src 'self' 'unsafe-inline' https://code.cdn.mozilla.net; connect-src 'self' www.google-analytics.com ${dsn}; font-src https://code.cdn.mozilla.net;`);
       res.header("X-Frame-Options", "DENY");
+      res.header("X-Content-Type-Options", "nosniff");
       addHSTS(req, res);
       next();
     } else {