From b951cb4422424fdc21ecde6f39be04c7b491685b Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Wed, 14 Dec 2022 13:39:47 +0000 Subject: [PATCH] [IMP] core: mark all responses as nosniff Doesn't seem like it could hurt, and should only make CORB more reliable by avoiding sniffing. Worst case scenario requires fixing a few mimetypes, but aside from CORB it looks like modern (non-IE) browsers only try to guess document mimetypes in very limited contexts. closes odoo/odoo#107957 Signed-off-by: Xavier Morel (xmo) --- odoo/http.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/odoo/http.py b/odoo/http.py index 386e89e7931..b47629cdc07 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -2051,6 +2051,8 @@ class Application: def set_csp(self, response): headers = response.headers + headers['X-Content-Type-Options'] = 'nosniff' + if 'Content-Security-Policy' in headers: return @@ -2059,7 +2061,6 @@ class Application: return headers['Content-Security-Policy'] = "default-src 'none'" - headers['X-Content-Type-Options'] = 'nosniff' def __call__(self, environ, start_response): """