Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consider returning "nosniff" for JSONP responses #38

Closed
onebytegone opened this issue Mar 21, 2019 · 2 comments
Closed

Consider returning "nosniff" for JSONP responses #38

onebytegone opened this issue Mar 21, 2019 · 2 comments
Assignees
@onebytegone

Comments

@onebytegone
Copy link
Contributor

As part of preventing Rosetta Flash, express sets the X-Content-Type-Options header to nosniff. lambda-express already has the /**/ mitigation, however should nosniff also be added?

See also: https://helmetjs.github.io/docs/dont-sniff-mimetype/
@jthomerson
Copy link
Member

Good find. Yes, let's add the same type of header-setting logic as Express. Also, let's add some comments in the code that clearly indicate that a) the nosniff header, b) the JS comment, and c) the typeof check are all mitigations against Rosetta Flash. Comment should reference this ticket.

onebytegone added a commit that referenced this issue Mar 21, 2019
@onebytegone
fix: Set nosniff for JSONP responses (#38)
35c5bf0
onebytegone added a commit that referenced this issue Mar 21, 2019
@onebytegone
fix: Set nosniff for JSONP responses (#38)
5ec51eb
onebytegone added a commit that referenced this issue Mar 22, 2019
@onebytegone
fix: Set nosniff for JSONP responses (#38)
896a25b
onebytegone added a commit that referenced this issue Mar 22, 2019
@onebytegone
feat: Set nosniff for JSONP responses (#38)
d558ca1
@onebytegone onebytegone mentioned this issue Mar 22, 2019
Merged
onebytegone added a commit that referenced this issue Mar 22, 2019
@onebytegone
feat: Set nosniff for JSONP responses (#38)
9e86d2a
onebytegone added a commit that referenced this issue Apr 1, 2019
@onebytegone
feat: Set nosniff for JSONP responses (#38)
eff35d7
onebytegone added a commit that referenced this issue Apr 1, 2019
@onebytegone
feat: Set nosniff for JSONP responses (#38)
5b5b7d9
@onebytegone
Copy link
Contributor Author

Closed with #42.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@onebytegone onebytegone

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jthomerson @onebytegone