[jboss-jira] [JBoss JIRA] (WFLY-12156) Add X-Content-Type-Options header to default management config
Jan Stourac created WFLY-12156:
----------------------------------
Summary: Add X-Content-Type-Options header to default management config
Key: WFLY-12156
URL: https://issues.jboss.org/browse/WFLY-12156
Project: WildFly
Issue Type: Enhancement
Components: Management
Affects Versions: 16.0.0.Final
Reporter: Jan Stourac
Assignee: Jeff Mesnil
Even though we should probably avoid using non-standardized HTTP headers, since there is
already X-FRAME-OPTIONS present in a management WFCORE-1463, I propose to consider to add
also
[X-Content-Type-Options|https://developer.mozilla.org/en-US/docs/Web/HTTP/...]
header in a default configuration of the management too.
Benefit is slightly improved security for customers using Web Console management.
Current header provided:
{code}
curl -v http://localhost:9990/console/index.html
...
< HTTP/1.1 200 OK
< Connection: keep-alive
< Last-Modified: Wed, 29 May 2019 11:09:49 GMT
< X-Frame-Options: SAMEORIGIN
< Content-Length: 1289
< Content-Type: text/html
< Accept-Ranges: bytes
< Date: Mon, 03 Jun 2019 08:05:05 GMT
...
{code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)