Browse Source

add X-Content-Type-Options: nosniff

pull/36/head
mutantmonkey 9 years ago
parent
commit
71d5f51ae6
  1. 6
      csp.go
  2. 1
      csp_test.go

6
csp.go

@ -5,8 +5,9 @@ import (
) )
const ( const (
cspHeader = "Content-Security-Policy"
frameOptionsHeader = "X-Frame-Options"
cspHeader = "Content-Security-Policy"
frameOptionsHeader = "X-Frame-Options"
contentTypeOptionsHeader = "X-Content-Type-Options"
) )
type csp struct { type csp struct {
@ -26,6 +27,7 @@ func (c csp) ServeHTTP(w http.ResponseWriter, r *http.Request) {
} }
w.Header().Set(frameOptionsHeader, c.opts.frame) w.Header().Set(frameOptionsHeader, c.opts.frame)
w.Header().Set(contentTypeOptionsHeader, "nosniff")
c.h.ServeHTTP(w, r) c.h.ServeHTTP(w, r)
} }

1
csp_test.go

@ -11,6 +11,7 @@ import (
var testCSPHeaders = map[string]string{ var testCSPHeaders = map[string]string{
"Content-Security-Policy": "default-src 'none'; style-src 'self';", "Content-Security-Policy": "default-src 'none'; style-src 'self';",
"X-Frame-Options": "SAMEORIGIN", "X-Frame-Options": "SAMEORIGIN",
"X-Content-Type-Options": "nosniff",
} }
func TestContentSecurityPolicy(t *testing.T) { func TestContentSecurityPolicy(t *testing.T) {

Loading…
Cancel
Save